PT-2009-2980 · Vim+1 · Vim+1
Jan Lieskovsky
·
Published
2009-01-28
·
Updated
2024-06-15
·
CVE-2009-0316
CVSS v2.0
6.9
Medium
| Vector | AV:L/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Vim versions prior to 7.2.045
Description
The issue is related to an untrusted search path vulnerability in the Python interface, allowing local users to execute arbitrary code via a Trojan horse Python file in the current working directory. This is due to a vulnerability in the
PySys SetArgv function. The vulnerability can be demonstrated by an erroneous search path for plugin/bike.vim in bicyclerepair.Recommendations
For versions prior to 7.2.045, update to version 7.2.045 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Python interface in Vim to minimize the risk of exploitation. Avoid using the
PySys SetArgv function in the affected Python interface until the issue is resolved.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Suse
Vim