PT-2017-10956 · Vim+2 · Vim+2

Hanno Böck · Published 2017-10-31 · Updated 2024-06-15 · CVE-2017-1000382

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions VIM version 8.0.1187

Description The issue concerns the creation of swap files by VIM, where the umask is ignored. This results in swap files, such as "[ORIGINAL FILENAME].swp", being potentially world-readable or accessible in unintended ways by other users.

Recommendations For version 8.0.1187, consider setting appropriate permissions on the directory where swap files are created to restrict access, until a fix is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2018-1878

CVE-2017-1000382

ECHO-AEF3-A0E0-F4DC

OPENSUSE-SU-2024:11497-1

Affected Products

Alt Linux

Debian

Vim

References · 32

• https://osv.dev/vulnerability/CVE-2017-1000382 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-1000382 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11497-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05951 · Security Note
• https://security-tracker.debian.org/tracker/source-package/vim · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/685443 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-1000382 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000382 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000382 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-1000382 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-1000382 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2018-1878 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17087 · Security Note
• https://bdu.fstec.ru/vul/2022-06483 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-1000382 · Vendor Advisory