CVE-2016-1248: Input Validation
vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/neovimto a version that resolves this vulnerability.Fixed in 0.1.6-r1 - Upgrade
Upgrade
alpine/vimto a version that resolves this vulnerability.Fixed in 8.0.0056-r0 - Upgrade
Upgrade
alpine/vimto a version that resolves this vulnerability.Fixed in 7.4.712-r1 - Upgrade
Upgrade
alpine/vimto a version that resolves this vulnerability.Fixed in 7.4.943-r4 - Upgrade
Upgrade
alpine/vimto a version that resolves this vulnerability.Fixed in 7.4.1831-r2 - Upgrade
Upgrade
vimto a version that resolves this vulnerability.Fixed in 8.0.0056
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1248?
CVE-2016-1248 is considered a critical vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2016-1248?
To fix CVE-2016-1248, update Vim to version 8.0.0056 or later.
What versions of Vim are affected by CVE-2016-1248?
Vim versions prior to 8.0.0056 are affected by CVE-2016-1248.
What types of systems are impacted by CVE-2016-1248?
CVE-2016-1248 impacts systems running affected versions of Vim, including certain Debian Linux distributions.
What are modelines in the context of CVE-2016-1248?
Modelines are lines in a file that can set editor options, and if crafted maliciously, they can exploit CVE-2016-1248.