Vim

vim

Vendor: Vim • 248 CVEs

CVEs (248)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-3974 3Debian FedoraprojectVim 3Debian Linux FedoraVim Jun 17, 2026 Nov 19, 2021 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 vim is vulnerable to Use After Free
CVE-2021-3928 3Debian FedoraprojectVim 3Debian Linux FedoraVim Jun 17, 2026 Nov 5, 2021 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 vim is vulnerable to Use of Uninitialized Variable
CVE-2021-3927 3Debian FedoraprojectVim 3Debian Linux FedoraVim Jun 17, 2026 Nov 5, 2021 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3903 3Debian FedoraprojectVim 3Debian Linux FedoraVim Jun 17, 2026 Oct 27, 2021 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3872 3Debian FedoraprojectVim 3Debian Linux FedoraVim Jun 17, 2026 Oct 19, 2021 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3875 2Fedoraproject Vim 2Fedora Vim Jun 17, 2026 Oct 15, 2021 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3796 4Debian FedoraprojectNetapp+1 more 4Debian Linux FedoraOntap Select Deploy Administration Utility+1 more Jun 17, 2026 Sep 15, 2021 N/A· v4 7.3 HIGH· v3 6.8 MEDIUM· v2 vim is vulnerable to Use After Free
CVE-2021-3778 4Debian FedoraprojectNetapp+1 more 4Debian Linux FedoraOntap Select Deploy Administration Utility+1 more Jun 17, 2026 Sep 15, 2021 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3770 3Fedoraproject NetappVim 3Fedora Ontap Select Deploy Administration UtilityVim Jun 17, 2026 Sep 6, 2021 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 vim is vulnerable to Heap-based Buffer Overflow
CVE-2019-20807 6Apple CanonicalDebian+3 more 7Command Center Debian LinuxLeap+4 more Jun 17, 2026 May 28, 2020 N/A· v4 5.3 MEDIUM· v3 4.6 MEDIUM· v2 In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).
CVE-2019-20079 2Canonical Vim 2Ubuntu Linux Vim Jun 17, 2026 Dec 30, 2019 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 The autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory.
CVE-2019-12735 2Neovim Vim 2Neovim Vim Jun 17, 2026 Jun 5, 2019 N/A· v4 8.6 HIGH· v3 9.3 HIGH· v2 getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input...Show more getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.Show less
CVE-2017-17087 3Canonical DebianVim 3Debian Linux Ubuntu LinuxVim May 13, 2026 Dec 1, 2017 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the group ownership of the original file), which allows local users to obtain sensitive...Show more fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the group ownership of the original file), which allows local users to obtain sensitive information by leveraging an applicable group membership, as demonstrated by /etc/shadow owned by root:shadow mode 0640, but /etc/.shadow.swp owned by root:users mode 0640, a different vulnerability than CVE-2017-1000382.Show less
CVE-2017-1000382 1Vim 1Vim May 13, 2026 Oct 31, 2017 N/A· v4 5.5 MEDIUM· v3 2.1 LOW· v2 VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways not intended by the...Show more VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.Show less
CVE-2017-11109 1Vim 1Vim May 13, 2026 Jul 8, 2017 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file. NOTE: there might be a limited number of scenarios in which this has secu...Show more Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file. NOTE: there might be a limited number of scenarios in which this has security relevance.Show less
CVE-2017-6350 1Vim 1Vim May 13, 2026 Feb 27, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to re...Show more An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.Show less
CVE-2017-6349 1Vim 1Vim May 13, 2026 Feb 27, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resulta...Show more An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.Show less
CVE-2017-5953 1Vim 1Vim May 13, 2026 Feb 10, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.
CVE-2016-1248 2Debian Vim 2Debian Linux Vim May 6, 2026 Nov 23, 2016 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.
CVE-2008-6235 1Vim 1Vim Apr 23, 2026 Feb 21, 2009 N/A· v4 N/A· v3 9.3 HIGH· v2 The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrw_curdir variable, as...Show more The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrw_curdir variable, as demonstrated using the netrw.v4 and netrw.v5 test cases.Show less

Previous 1...9 10 111213 Next