PT-2017-10956 · Vim+2 · Vim+2

Hanno Böck · Publicado 2017-10-31 · Atualizado 2024-06-15 · CVE-2017-1000382

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions VIM version 8.0.1187

Description The issue concerns the creation of swap files by VIM, where the umask is ignored. This results in swap files, such as "[ORIGINAL FILENAME].swp", being potentially world-readable or accessible in unintended ways by other users.

Recommendations For version 8.0.1187, consider setting appropriate permissions on the directory where swap files are created to restrict access, until a fix is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2018-1878

CVE-2017-1000382

ECHO-AEF3-A0E0-F4DC

OPENSUSE-SU-2024:11497-1

Produtos afetados

Alt Linux

Debian

Vim

Referências · 32

• https://osv.dev/vulnerability/CVE-2017-1000382 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2017/10/31/1 · Nota
• https://suse.com/security/cve/CVE-2017-6349 · Nota
• https://security-tracker.debian.org/tracker/CVE-2017-1000382 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-6350 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:11497-1 · Aviso do Fabricante
• https://t.me/cvenotify/27081 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2022-05951 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2017-1000382 · Nota
• https://suse.com/security/cve/CVE-2007-2438 · Nota
• https://security-tracker.debian.org/tracker/source-package/vim · Aviso do Fabricante
• https://safe-surf.ru/specialists/bulletins-nkcki/685443 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2017-1000382 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000382 · Nota de Segurança
• http://security.cucumberlinux.com/security/details.php?id=120 · Nota