PT-2016-4670 · Vim+5 · Vim+5

Bram Moolenaar + 1 · Publicado 2016-11-22 · Atualizado 2022-12-27 · CVE-2016-1248

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vim versions prior to 8.0.0056

Description The issue arises from improper validation of values for the filetype, syntax, and keymap options. This can lead to the execution of arbitrary code when a file with a specially crafted modeline is opened.

Recommendations For versions prior to 8.0.0056, update to a version that includes patch 8.0.0056 or later to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2016-2338

CESA-2016_2972

CVE-2016-1248

DLA-718-1

DSA-3722-1

MGASA-2017-0275

OPENSUSE-SU-2016_2992-1

OPENSUSE-SU-2016_2993-1

RHSA-2016:2972

RHSA-2016_2972

SUSE-SU-2016:2938-1

SUSE-SU-2016:2942-1

SUSE-SU-2016_2938-1

SUSE-SU-2016_2942-1

SUSE-SU-2022:4619-1

USN-3139-1

Produtos afetados

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Vim

Referências · 249

• https://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba72795040 · Aviso do Fabricante
• https://github.com/vim/vim/releases/tag/v8.0.0056 · Aviso do Fabricante
• https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39a · Aviso do Fabricante
• https://bugzilla.suse.com/1200270 · Nota
• https://bugzilla.suse.com/1200012 · Nota
• https://bugzilla.suse.com/1199747 · Nota
• https://bugzilla.suse.com/1199745 · Nota
• https://suse.com/security/cve/CVE-2021-4069 · Nota
• https://bugzilla.suse.com/1201136 · Nota
• https://suse.com/security/cve/CVE-2022-2344 · Nota
• https://suse.com/security/cve/CVE-2022-2923 · Nota
• https://bugzilla.suse.com/1201356 · Nota
• https://bugzilla.suse.com/1194216 · Nota
• https://suse.com/security/cve/CVE-2021-3928 · Nota
• https://suse.com/security/cve/CVE-2022-1897 · Nota