CVE-2004-1138

2005-01-1005:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

vulnerability

vim

gvim

local users

execute

arbitrary commands

crafted modeline

6.8 Medium

AI Score

Confidence

Low

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

25.3%

JSON

VIM before 6.3 and gVim before 6.3 allow local users to execute arbitrary commands via a file containing a crafted modeline that is executed when the file is viewed using options such as (1) termcap, (2) printdevice, (3) titleold, (4) filetype, (5) syntax, (6) backupext, (7) keymap, (8) patchmode, or (9) langmenu.

CPENameOperatorVersion
vim_development_group:vimvim development group vimeq6.0
vim_development_group:vimvim development group vimeq5.4
vim_development_group:vimvim development group vimeq5.6
vim_development_group:vimvim development group vimeq5.3
vim_development_group:vimvim development group vimeq5.8
vim_development_group:vimvim development group vimeq5.0
vim_development_group:vimvim development group vimeq6.3.011
vim_development_group:vimvim development group vimeq5.5
vim_development_group:vimvim development group vimeq6.3.025
vim_development_group:vimvim development group vimeq6.3.044

CPE	Name	Operator	Version
vim_development_group:vim	vim development group vim	eq	6.0
vim_development_group:vim	vim development group vim	eq	5.4
vim_development_group:vim	vim development group vim	eq	5.6
vim_development_group:vim	vim development group vim	eq	5.3
vim_development_group:vim	vim development group vim	eq	5.8
vim_development_group:vim	vim development group vim	eq	5.0
vim_development_group:vim	vim development group vim	eq	6.3.011
vim_development_group:vim	vim development group vim	eq	5.5
vim_development_group:vim	vim development group vim	eq	6.3.025
vim_development_group:vim	vim development group vim	eq	6.3.044