8.6 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.003 Low
EPSS
Percentile
71.3%
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote
attackers to execute arbitrary OS commands via the :source! command in a
modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input
in Neovim.
Author | Note |
---|---|
leosilva | neither precise/esm or trusty/esm seems to be affected. The POC was not reproducible in these releases |
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 18.04 | noarch | neovim | < 0.2.2-3ubuntu0.1~esm1 | UNKNOWN |
ubuntu | 18.10 | noarch | neovim | < 0.3.1-1ubuntu0.1 | UNKNOWN |
ubuntu | 19.04 | noarch | neovim | < 0.3.4-1ubuntu0.19.04.1 | UNKNOWN |
ubuntu | 18.04 | noarch | vim | < 2:8.0.1453-1ubuntu1.1 | UNKNOWN |
ubuntu | 18.10 | noarch | vim | < 2:8.0.1766-1ubuntu1.1 | UNKNOWN |
ubuntu | 19.04 | noarch | vim | < 2:8.1.0320-1ubuntu3.1 | UNKNOWN |
ubuntu | 19.10 | noarch | vim | < 2:8.1.0875-4ubuntu1 | UNKNOWN |
ubuntu | 20.04 | noarch | vim | < 2:8.1.0875-4ubuntu1 | UNKNOWN |
ubuntu | 20.10 | noarch | vim | < 2:8.1.0875-4ubuntu1 | UNKNOWN |
ubuntu | 21.04 | noarch | vim | < 2:8.1.0875-4ubuntu1 | UNKNOWN |
github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md
launchpad.net/bugs/cve/CVE-2019-12735
nvd.nist.gov/vuln/detail/CVE-2019-12735
security-tracker.debian.org/tracker/CVE-2019-12735
ubuntu.com/security/notices/USN-4016-1
ubuntu.com/security/notices/USN-4016-2
ubuntu.com/security/notices/USN-4862-1
www.cve.org/CVERecord?id=CVE-2019-12735
8.6 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.003 Low
EPSS
Percentile
71.3%