CVE-2005-2368 vim 6.3 before 6.3.082, with modelines enabled, allows external user-assisted attackers to execute arbitrary commands via shell metacharacters in the (1) glob or (2) expand commands of a foldexpr expr...
HighCVSS 9.3
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
vim 6.3 before 6.3.082, with modelines enabled, allows external user-assisted attackers to execute arbitrary commands via shell metacharacters in the (1) glob or (2) expand commands of a foldexpr expression for calculating fold levels.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vim development group vim | = 6.3 | No fix listed |
| vim development group vim | = 6.3.011 | No fix listed |
| vim development group vim | = 6.3.025 | No fix listed |
| vim development group vim | = 6.3.030 | No fix listed |
| vim development group vim | = 6.3.044 | No fix listed |
| vim development group vim | = 6.3.081 | No fix listed |
| debian/vim(Debian:12) | < 1:6.3-085+1 | 1:6.3-085+1 |
| debian/vim(Debian:13) | < 1:6.3-085+1 | 1:6.3-085+1 |
| debian/vim(Debian:14) | < 1:6.3-085+1 | 1:6.3-085+1 |
References
- 20050725 Help poor children in Uganda exploit mailing-list patch vendor-advisory
- www.guninski.com exploit patch vendor-advisory
- RHSA-2005:745 vendor-advisory
- 14374 vdb-entry
- oval:org.mitre.oval:def:11302 signature vdb-entry
- Debian Security Tracker CVE-2005-2368 vendor-advisory
- bugs.debian.org issue-tracking