PT-2016-4670 · Vim+5 · Vim+5

Bram Moolenaar + 1 · Published 2016-11-22 · Updated 2022-12-27 · CVE-2016-1248

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vim versions prior to 8.0.0056

Description The issue arises from improper validation of values for the filetype, syntax, and keymap options. This can lead to the execution of arbitrary code when a file with a specially crafted modeline is opened.

Recommendations For versions prior to 8.0.0056, update to a version that includes patch 8.0.0056 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2016-2338

CESA-2016_2972

CVE-2016-1248

DLA-718-1

DSA-3722-1

MGASA-2017-0275

OPENSUSE-SU-2016_2992-1

OPENSUSE-SU-2016_2993-1

RHSA-2016:2972

RHSA-2016_2972

SUSE-SU-2016:2938-1

SUSE-SU-2016:2942-1

SUSE-SU-2016_2938-1

SUSE-SU-2016_2942-1

SUSE-SU-2022:4619-1

USN-3139-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Vim

References · 249

• https://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba72795040 · Vendor Advisory
• https://github.com/vim/vim/releases/tag/v8.0.0056 · Vendor Advisory
• https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39a · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0275.html · Security Note
• https://cve.org/CVERecord?id=CVE-2016-1248 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2016-1248 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4619-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1248 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-1248 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2016-2972.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-1248 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-1248 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3139-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1248 · Vendor Advisory
• https://security.gentoo.org/glsa/201701-29 · Vendor Advisory