CVE-2017-1000382: Infoleak
Published Oct 31, 2017
·Updated
VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINALFILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.
Affected Software
1 affected component
vim Vim<=8.0.1187
Event History
Oct 31, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-1000382?
CVE-2017-1000382 has a medium severity rating due to potential unauthorized access to sensitive data.
2
How do I fix CVE-2017-1000382?
To fix CVE-2017-1000382, update VIM to version 8.0.1190 or later where this issue is resolved.
3
What versions are affected by CVE-2017-1000382?
CVE-2017-1000382 affects VIM versions up to 8.0.1187 inclusively.
4
What impact does CVE-2017-1000382 have on my system?
CVE-2017-1000382 allows the creation of swap files that may be world readable, leading to potential data leaks.
5
Is VIM running with elevated user privileges a risk for CVE-2017-1000382?
Yes, if VIM is run with elevated privileges, CVE-2017-1000382 increases the risk of exposing sensitive files to unintended users.