PT-2007-4250 · Vim+1 · Vim+1

Published 2007-07-31 · Updated 2024-06-15 · CVE-2007-2953

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Vim versions prior to 7.1 Vim version 6.4 and earlier

Description The issue is related to a format string vulnerability in the helptags one function. This vulnerability allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a help-tags tag in a help file. The vulnerability is related to the helptags command.

Recommendations For Vim versions prior to 7.1, update to version 7.1 or later to resolve the issue. For Vim version 6.4 and earlier, update to a version later than 6.4 to mitigate the risk. As a temporary workaround, consider restricting the use of the helptags command until a patch is available.

Fix

Related Identifiers

CVE-2007-2953

DSA-1364-1

DSA-1364-2

OPENSUSE-SU-2024:11497-1

RHSA-2008:0580

RHSA-2008:0617

RHSA-2008_0580

RHSA-2008_0617

Affected Products

Red Hat

Vim

References · 61

• http://securityfocus.com/bid/25095 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:11497-1 · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_18_sr.html · Vendor Advisory
• http://debian.org/security/2007/dsa-1364 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0580.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0617.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-2953 · Vendor Advisory
• http://trustix.org/errata/2007/0026 · Vendor Advisory
• ftp://ftp.vim.org/pub/vim/patches/7.1/7.1.039 · Patch
• http://ubuntu.com/usn/usn-505-1 · Vendor Advisory
• http://secunia.com/advisories/25941 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:168 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2953 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-2953 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:236 · Vendor Advisory