PatchTheCVEvim development group vulnerabilities
Recent CVEs affecting vim development group products. 8 tracked.
vim development group has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2007-07-31. Highest priority: CVE-2005-2368 (score 59/100).
- CVE-2007-2953 MEDIUM 6.8 UPGRADE Format string vulnerability in the helptags_one function in src/ex_cmds.c in Vim 6.4 and earlier, and 7.x up t
- CVE-2007-2438 HIGH 7.6 DOWNGRADE The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which migh
- CVE-2005-2368 HIGH 9.3 DOWNGRADE vim 6.3 before 6.3.082, with modelines enabled, allows external user-assisted attackers to execute arbitrary c
- CVE-2005-0069 MEDIUM 4.6 DOWNGRADE The (1) tcltags or (2) vimspell.sh scripts in vim 6.3 allow local users to overwrite or create arbitrary files
- CVE-2004-1138 HIGH 7.2 DOWNGRADE VIM before 6.3 and gVim before 6.3 allow local users to execute arbitrary commands via a file containing a cra
- CVE-2002-1377 MEDIUM 4.6 DOWNGRADE vim 6.0 and 6.1, and possibly other versions, allows attackers to execute arbitrary commands using the libcall
- CVE-2001-0409 LOW 2.1 DOWNGRADE vim (aka gvim) allows local users to modify files being edited by other users via a symlink attack on the back
- CVE-2001-0408 MEDIUM 5.1 DOWNGRADE vim (aka gvim) processes VIM control codes that are embedded in a file, which could allow attackers to execute
FAQ
How do I fix vim development group vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is vim development group being exploited right now?
None of the tracked vim development group CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which vim development group CVE should I patch first?
CVE-2005-2368 currently ranks highest (59/100): vim 6.3 before 6.3.082, with modelines enabled, allows external user-assisted attackers to execute arbitrary c.