Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765.
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the operand parameter.
Untrusted search path vulnerability in VIM Development Group GVim before 7.3.034, and possibly other versions before 7.3.46, allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse User32.dll or other DLL that is located in the same folder as a .TXT file. NOTE: some of these details are obtained from third party information.
Description of problem:
Jan Minar has reported the following problem present in Vim shellescape() function implementation and demonstrated by testcases in tar.vim plugin:
The implementation of the shellescape() function does not properly escape all special items, in particular the '!' character). This can result in untrusted data being insufficiently sanitized and possibly lead to arbitrary code execution.
To show this vulnerability can be exploited, the tar.vim plugin test cases has been updated (tarplugin, tarplugin.v2 and tarplugin.updated test cases).
CVE-2008-3074 has been pre-assigned and used in rPath advisory:
http://www.openwall.com/lists/oss-security/2008/07/10/7
References:
http://www.rdancer.org/vulnerablevim-shellescape.html http://www.openwall.com/lists/oss-security/2008/07/15/2 http://www.openwall.com/lists/oss-security/2008/07/10/7 http://www.rdancer.org/vulnerablevim.html http://www.openwall.com/lists/oss-security/2008/07/13/1 http://www.openwall.com/lists/oss-security/2008/08/01/1
Description of problem:
Jan Minar has reported the following problem present in Vim shellescape() function implementation and demonstrated by testcases in zip.vim plugin:
The implementation of the shellescape() function does not properly escape all special items, in particular the '!' character). This can result in untrusted data being insufficiently sanitized and possibly lead to arbitrary code execution.
To show this vulnerability can be exploited, the tar.vim plugin test cases has been updated (zipplugin and zipplugin.v2 test cases).
CVE-2008-3075 as been pre-assigned and used in rPath advisory:
http://www.openwall.com/lists/oss-security/2008/07/10/7 (ZIP-2)
References:
http://www.rdancer.org/vulnerablevim-shellescape.html http://www.rdancer.org/vulnerablevim.html (ZIP-1) http://www.openwall.com/lists/oss-security/2008/07/15/2 http://www.openwall.com/lists/oss-security/2008/07/13/1 (ZIP-4) http://www.openwall.com/lists/oss-security/2008/08/01/1
CVE-2008-2712 bullet (2)
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2712
mentions zipplugin based on same advisory as ZIP-1. According to ZIP-2 and ZIP-4 the zip.vim / zipplugin.vim has not been fixed as of Vim 7.2a.19/zip.vim v19, so the bullet (2) -- mention about zipplugin should be removed from CVE-2008-2712.
The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-2712 to the following vulnerability:
Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions, as demonstrated using (1) filetype.vim, (2) zipplugin, (3) xpm.vim, (4) gzipvim, and (5) netrw.
References: http://www.rdancer.org/vulnerablevim.html http://www.securityfocus.com/archive/1/archive/1/493352/100/0/threaded http://www.securityfocus.com/archive/1/archive/1/493353/100/0/threaded http://marc.info/?l=bugtraq&m=121345541027231&w=4 http://www.openwall.com/lists/oss-security/2008/06/16/2 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=486502
Description of problem:
Ben Schmidt has discovered the following security flaw in Vim, which could lead to arbitrary code execution. Insufficient sanitization can lead to Vim executing arbitrary commands when performing keyword or tag lookup.
Flaw description pasted from original rdancer.org report (see [1]):
3.1. Keyword Lookup -- The K'' Command 3.1.1. Shell Commands and Ex Commands
Because the string passed to the shell for execution is not sanitized, it is possible to specify arbitrary shell commands where Vim expects an argument for the keyword program. Same applies to arbitrary Ex commands.
3.1.2. Keyword Program Command Line Switches
It is possible to specify command line switches for the keyword program in place of the argument. The gravity of this vulnerability depends on the keyword program selected. GNU man, the default keyword program in many installations, supports for example the --pager'' option (cf. the GNU man(1) manual page). This allows arbitrary command execution.
3.2. Tag Lookup -- the Control-]'' and g]'' Commands
Insufficient sanitization of an Ex command argument allows specifying additional arbitrary Ex commands in place of the argument.
3.3. Unknown Shell/Keyword Program
Because the syntax of the shell that is being used to execute the commands is not known beforehand, there may be other unknown vulnerabilities, that are present depending on the shell being used. Ditto for the man(1) program, and other keyword programs.
Version-Release number of selected component (if applicable): 3.0--current, possibly older
How reproducible: Always
Steps to Reproduce: 1. See part "4.EXPLOIT" from the original rdancer.org report [1] Actual results: Arbitrary code execution possible
Expected results: No security flaw present.
References:
[1] http://www.rdancer.org/vulnerablevim-K.html
Proposed patch:
Report: http://groups.google.com/group/vimdev/msg/dd32ad3a84f36bb2 Patch: http://groups.google.com/group/vimdev/attach/dd32ad3a84f36bb2/K-arbitrary-command-execution.patch?part=2
RH SRT official statement:
This issue affects all versions of the vim-enhanced package, as shipped with Red Hat Enterprise Linux 2.1, 3, 4 and 5 and within Fedora releases of 8, 9 and 10.
Last updated 21 August 2024
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
vim is vulnerable to Heap-based Buffer Overflow
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
Last updated 24 July 2024
Last updated 24 July 2024
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402.
Last updated 24 July 2024
Last updated 24 July 2024
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331.
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.
Last updated 24 July 2024