CVE-2008-2712

Published: Jun 16, 2008Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions, as demonstrated using (1) filetype.vim, (3) xpm.vim, (4) gzip_vim, and (5) netrw. NOTE: the originally reported version was 7.1.314, but the researcher actually found this set of issues in 7.1.298. NOTE: the zipplugin issue (originally vector 2 in this identifier) has been subsumed by CVE-2008-3075.

Affected (6)

Products: Vim: Vim · Canonical: Ubuntu Linux

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Vim Vim	Up to 6.4
Vim Vim	From 7.0 to 7.1.314

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 7.10
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 8.10

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (80)

http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html

Source: cve@mitre.org

Third Party Advisory

http://marc.info/?l=bugtraq&m=121494431426308&w=2

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://secunia.com/advisories/30731

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/32222

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/32858

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/32864

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/33410

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/34418

Source: cve@mitre.org

Third Party Advisory

http://securityreason.com/securityalert/3951

Source: cve@mitre.org

Third Party Advisory

http://support.apple.com/kb/HT3216

Source: cve@mitre.org

Third Party Advisory

http://support.apple.com/kb/HT4077

Source: cve@mitre.org

Third Party Advisory

http://support.avaya.com/elmodocs2/security/ASA-2008-457.htm

Source: cve@mitre.org

Third Party Advisory

http://support.avaya.com/elmodocs2/security/ASA-2009-001.htm

Source: cve@mitre.org

Third Party Advisory

http://wiki.rpath.com/Advisories:rPSA-2008-0247

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:236

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2008/06/16/2

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2008/10/15/1

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.rdancer.org/vulnerablevim.html

Source: cve@mitre.org

Broken Link

http://www.redhat.com/support/errata/RHSA-2008-0580.html

Source: cve@mitre.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0617.html

Source: cve@mitre.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0618.html

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/archive/1/493352/100/0/threaded

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/493353/100/0/threaded

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/495319/100/0/threaded

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/502322/100/0/threaded

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/29715

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/31681

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1020293

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-712-1

Source: cve@mitre.org

Third Party Advisory

http://www.vmware.com/security/advisories/VMSA-2009-0004.html

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2008/1851/references

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2008/2780

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2009/0033

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2009/0904

Source: cve@mitre.org

Third Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/43083

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://issues.rpath.com/browse/RPL-2622

Source: cve@mitre.org

Broken Link

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11109

Source: cve@mitre.org

Third Party Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6238

Source: cve@mitre.org

Third Party Advisory

http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html