CVE-2016-1248

Published: Nov 23, 2016Modified: May 6, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.

Affected (2)

Products: Vim: Vim · Debian: Debian Linux

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Vim Vim	Up to 8.0.0055

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (26)

http://openwall.com/lists/oss-security/2016/11/22/20

Source: security@debian.org

PatchThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-2972.html

Source: security@debian.org

http://www.debian.org/security/2016/dsa-3722

Source: security@debian.org

http://www.securityfocus.com/bid/94478

Source: security@debian.org

http://www.securitytracker.com/id/1037338

Source: security@debian.org

http://www.ubuntu.com/usn/USN-3139-1

Source: security@debian.org

https://anonscm.debian.org/cgit/pkg-vim/vim.git/tree/debian/changelog

Source: security@debian.org

PatchThird Party Advisory

https://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba72795040

Source: security@debian.org

PatchVendor Advisory

https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39a

Source: security@debian.org

PatchVendor Advisory

https://github.com/vim/vim/releases/tag/v8.0.0056

Source: security@debian.org

PatchVendor Advisory

https://lists.debian.org/debian-lts-announce/2016/11/msg00025.html

Source: security@debian.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-security-announce/2016/msg00305.html

Source: security@debian.org

Third Party Advisory

https://security.gentoo.org/glsa/201701-29

Source: security@debian.org

http://openwall.com/lists/oss-security/2016/11/22/20