PT-2010-5165 · Vim Development · Gvim

Makoto Shiotsuki · Publicado 2010-11-03 · Atualizado 2010-11-05 · CVE-2010-3914

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VIM Development Group GVim versions prior to 7.3.46

Description The issue allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse User32.dll or other DLL that is located in the same folder as a .TXT file.

Recommendations For versions prior to 7.3.46, update to version 7.3.46 or later to resolve the issue. As a temporary workaround, consider restricting access to untrusted search paths to minimize the risk of exploitation. Avoid executing GVim from untrusted directories to prevent DLL hijacking attacks.

Correção

Identificadores relacionados

CVE-2010-3914

Produtos afetados

Gvim

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2010-3914 · Nota de Segurança
• http://secunia.com/advisories/42084 · Aviso do Fabricante
• http://securityfocus.com/bid/44588 · Nota
• ftp://ftp.vim.org/pub/vim/patches/7.3/7.3.034 · Correção
• http://jvn.jp/en/jp/JVN27868039/index.html · Correção
• http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000051.html · Nota