Vim vulnerabilities

2009-01-2700:00:00

ubuntu.com

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.2 High

AI Score

Confidence

Low

0.011 Low

EPSS

Percentile

84.2%

JSON

Releases

Ubuntu 8.10
Ubuntu 8.04
Ubuntu 7.10
Ubuntu 6.06

Packages

vim -

Details

Jan Minar discovered that Vim did not properly sanitize inputs before invoking
the execute or system functions inside Vim scripts. If a user were tricked
into running Vim scripts with a specially crafted input, an attacker could
execute arbitrary code with the privileges of the user invoking the program.
(CVE-2008-2712)

Ben Schmidt discovered that Vim did not properly escape characters when
performing keyword or tag lookups. If a user were tricked into running specially
crafted commands, an attacker could execute arbitrary code with the privileges
of the user invoking the program. (CVE-2008-4101)

OSVersionArchitecturePackageVersionFilename
Ubuntu8.10noarchvim-runtime< 1:7.1.314-3ubuntu3.1UNKNOWN
Ubuntu8.10noarchvim< 1:7.1.314-3ubuntu3.1UNKNOWN
Ubuntu8.10noarchvim-common< 1:7.1.314-3ubuntu3.1UNKNOWN
Ubuntu8.10noarchvim-dbg< 1:7.1.314-3ubuntu3.1UNKNOWN
Ubuntu8.10noarchvim-gnome< 1:7.1.314-3ubuntu3.1UNKNOWN
Ubuntu8.10noarchvim-gtk< 1:7.1.314-3ubuntu3.1UNKNOWN
Ubuntu8.10noarchvim-nox< 1:7.1.314-3ubuntu3.1UNKNOWN
Ubuntu8.10noarchvim-tiny< 1:7.1.314-3ubuntu3.1UNKNOWN
Ubuntu8.04noarchvim-runtime< 1:7.1-138+1ubuntu3.1UNKNOWN
Ubuntu8.04noarchvim< 1:7.1-138+1ubuntu3.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	8.10	noarch	vim-runtime	< 1:7.1.314-3ubuntu3.1	UNKNOWN
Ubuntu	8.10	noarch	vim	< 1:7.1.314-3ubuntu3.1	UNKNOWN
Ubuntu	8.10	noarch	vim-common	< 1:7.1.314-3ubuntu3.1	UNKNOWN
Ubuntu	8.10	noarch	vim-dbg	< 1:7.1.314-3ubuntu3.1	UNKNOWN
Ubuntu	8.10	noarch	vim-gnome	< 1:7.1.314-3ubuntu3.1	UNKNOWN
Ubuntu	8.10	noarch	vim-gtk	< 1:7.1.314-3ubuntu3.1	UNKNOWN
Ubuntu	8.10	noarch	vim-nox	< 1:7.1.314-3ubuntu3.1	UNKNOWN
Ubuntu	8.10	noarch	vim-tiny	< 1:7.1.314-3ubuntu3.1	UNKNOWN
Ubuntu	8.04	noarch	vim-runtime	< 1:7.1-138+1ubuntu3.1	UNKNOWN
Ubuntu	8.04	noarch	vim	< 1:7.1-138+1ubuntu3.1	UNKNOWN