CVE-2004-1138: High severity vim development group vim vulnerability

Published Dec 22, 2004

Updated

VIM before 6.3 and gVim before 6.3 allow local users to execute arbitrary commands via a file containing a crafted modeline that is executed when the file is viewed using options such as (1) termcap, (2) printdevice, (3) titleold, (4) filetype, (5) syntax, (6) backupext, (7) keymap, (8) patchmode, or (9) langmenu.

Affected Software

16 affected components

Vim Development Group Vim=5.0

Vim Development Group Vim=5.1

Vim Development Group Vim=5.2

Vim Development Group Vim=5.3

Vim Development Group Vim=5.4

Vim Development Group Vim=5.5

Vim Development Group Vim=5.6

Vim Development Group Vim=5.7

Vim Development Group Vim=5.8

Vim Development Group Vim=6.0

Vim Development Group Vim=6.1

Vim Development Group Vim=6.2

Vim Development Group Vim=6.3.011

Vim Development Group Vim=6.3.025

Vim Development Group Vim=6.3.030

Vim Development Group Vim=6.3.044

Remediation

Patch Available

http://www.gentoo.org/security/en/glsa/glsa-200412-10.xml

Event History

Dec 22, 2004

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-1138?

CVE-2004-1138 is classified as a high severity vulnerability due to its ability to allow local users to execute arbitrary commands.

How do I fix CVE-2004-1138?

To fix CVE-2004-1138, upgrade to Vim 6.3 or later which contains the necessary patches addressing this vulnerability.

Who is affected by CVE-2004-1138?

CVE-2004-1138 affects local users of Vim versions prior to 6.3 across multiple versions including 5.0 to 6.2.

What vulnerabilities are similar to CVE-2004-1138?

Similar vulnerabilities include various command injection vulnerabilities in text editors that allow arbitrary code execution through crafted files.

Can CVE-2004-1138 be exploited remotely?

No, CVE-2004-1138 requires local access to the system to exploit the vulnerability.