CVE-2017-17087: Medium severity vim Vim vulnerability
fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the group ownership of the original file), which allows local users to obtain sensitive information by leveraging an applicable group membership, as demonstrated by /etc/shadow owned by root:shadow mode 0640, but /etc/.shadow.swp owned by root:users mode 0640, a different vulnerability than CVE-2017-1000382.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2017-17087?
CVE-2017-17087 is a vulnerability in Vim prior to version 8.0.1263 that allows local users to obtain sensitive information.
What is the severity of CVE-2017-17087?
The severity of CVE-2017-17087 is medium, with a severity value of 5.5.
How does CVE-2017-17087 affect Vim?
CVE-2017-17087 affects Vim versions prior to 8.0.1263.
How can I fix CVE-2017-17087?
To fix CVE-2017-17087, update Vim to version 8.0.1263 or higher.
Are there any references for CVE-2017-17087?
Yes, you can find references for CVE-2017-17087 at the following links: [1](http://openwall.com/lists/oss-security/2017/11/27/2), [2](http://security.cucumberlinux.com/security/details.php?id=166), [3](https://github.com/vim/vim/commit/5a73e0ca54c77e067c3b12ea6f35e3e8681e8cf8).