CVE-2002-1377

2004-09-0104:00:00

mitre

web.nvd.nist.gov

vim

arbitrary command execution

modelines

nvd

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

25.1%

JSON

vim 6.0 and 6.1, and possibly other versions, allows attackers to execute arbitrary commands using the libcall feature in modelines, which are not sandboxed but may be executed when vim is used to edit a malicious file, as demonstrated using mutt.

Affected configurations

Nvd

Node

vim_development_groupvimMatch5.0

vim_development_groupvimMatch5.1

vim_development_groupvimMatch5.2

vim_development_groupvimMatch5.3

vim_development_groupvimMatch5.4

vim_development_groupvimMatch5.5

vim_development_groupvimMatch5.6

vim_development_groupvimMatch5.7

vim_development_groupvimMatch5.8

vim_development_groupvimMatch6.0

vim_development_groupvimMatch6.1

VendorProductVersionCPE
vim_development_groupvim5.0cpe:2.3:a:vim_development_group:vim:5.0:*:*:*:*:*:*:*
vim_development_groupvim5.1cpe:2.3:a:vim_development_group:vim:5.1:*:*:*:*:*:*:*
vim_development_groupvim5.2cpe:2.3:a:vim_development_group:vim:5.2:*:*:*:*:*:*:*
vim_development_groupvim5.3cpe:2.3:a:vim_development_group:vim:5.3:*:*:*:*:*:*:*
vim_development_groupvim5.4cpe:2.3:a:vim_development_group:vim:5.4:*:*:*:*:*:*:*
vim_development_groupvim5.5cpe:2.3:a:vim_development_group:vim:5.5:*:*:*:*:*:*:*
vim_development_groupvim5.6cpe:2.3:a:vim_development_group:vim:5.6:*:*:*:*:*:*:*
vim_development_groupvim5.7cpe:2.3:a:vim_development_group:vim:5.7:*:*:*:*:*:*:*
vim_development_groupvim5.8cpe:2.3:a:vim_development_group:vim:5.8:*:*:*:*:*:*:*
vim_development_groupvim6.0cpe:2.3:a:vim_development_group:vim:6.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
vim_development_group	vim	5.0	cpe:2.3:a:vim_development_group:vim:5.0:::::::*
vim_development_group	vim	5.1	cpe:2.3:a:vim_development_group:vim:5.1:::::::*
vim_development_group	vim	5.2	cpe:2.3:a:vim_development_group:vim:5.2:::::::*
vim_development_group	vim	5.3	cpe:2.3:a:vim_development_group:vim:5.3:::::::*
vim_development_group	vim	5.4	cpe:2.3:a:vim_development_group:vim:5.4:::::::*
vim_development_group	vim	5.5	cpe:2.3:a:vim_development_group:vim:5.5:::::::*
vim_development_group	vim	5.6	cpe:2.3:a:vim_development_group:vim:5.6:::::::*
vim_development_group	vim	5.7	cpe:2.3:a:vim_development_group:vim:5.7:::::::*
vim_development_group	vim	5.8	cpe:2.3:a:vim_development_group:vim:5.8:::::::*
vim_development_group	vim	6.0	cpe:2.3:a:vim_development_group:vim:6.0:::::::*