Lucene search

K
osvGoogleOSV:DSA-1733-1
HistoryMar 03, 2009 - 12:00 a.m.

vim - multiple vulnerabilities

2009-03-0300:00:00
Google
osv.dev
9

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.011 Low

EPSS

Percentile

82.2%

Several vulnerabilities have been found in vim, an enhanced vi editor.
The Common Vulnerabilities and Exposures project identifies the
following problems:

  • CVE-2008-2712
    Jan Minar discovered that vim did not properly sanitise inputs
    before invoking the execute or system functions inside vim
    scripts. This could lead to the execution of arbitrary code.
  • CVE-2008-3074
    Jan Minar discovered that the tar plugin of vim did not properly
    sanitise the filenames in the tar archive or the name of the
    archive file itself, making it prone to arbitrary code execution.
  • CVE-2008-3075
    Jan Minar discovered that the zip plugin of vim did not properly
    sanitise the filenames in the zip archive or the name of the
    archive file itself, making it prone to arbitrary code execution.
  • CVE-2008-3076
    Jan Minar discovered that the netrw plugin of vim did not properly
    sanitise the filenames or directory names it is given. This could
    lead to the execution of arbitrary code.
  • CVE-2008-4101
    Ben Schmidt discovered that vim did not properly escape characters
    when performing keyword or tag lookups. This could lead to the
    execution of arbitrary code.

For the oldstable distribution (etch), these problems have been fixed in
version 1:7.0-122+1etch5.

For the stable distribution (lenny), these problems have been fixed in
version 1:7.1.314-3+lenny1, which was already included in the lenny
release.

For the testing distribution (squeeze), these problems have been fixed
in version 1:7.1.314-3+lenny1.

For the unstable distribution (sid), these problems have been fixed in
version 2:7.2.010-1.

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.011 Low

EPSS

Percentile

82.2%