CVE-2008-2712 (GCVE-0-2008-2712)
Vulnerability from cvelistv5
Published
2008-06-16 21:00
Modified
2024-08-07 09:14
Severity ?
CWE
  • n/a
Summary
Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions, as demonstrated using (1) filetype.vim, (3) xpm.vim, (4) gzip_vim, and (5) netrw. NOTE: the originally reported version was 7.1.314, but the researcher actually found this set of issues in 7.1.298. NOTE: the zipplugin issue (originally vector 2 in this identifier) has been subsumed by CVE-2008-3075.
References
http://www.vmware.com/security/advisories/VMSA-2009-0004.html x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html vendor-advisory, x_refsource_SUSE
http://www.redhat.com/support/errata/RHSA-2008-0618.html vendor-advisory, x_refsource_REDHAT
http://www.rdancer.org/vulnerablevim.html x_refsource_MISC
http://www.ubuntu.com/usn/USN-712-1 vendor-advisory, x_refsource_UBUNTU
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6238 vdb-entry, signature, x_refsource_OVAL
http://www.securityfocus.com/bid/31681 vdb-entry, x_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilities/43083 vdb-entry, x_refsource_XF
http://secunia.com/advisories/32858 third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/33410 third-party-advisory, x_refsource_SECUNIA
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html vendor-advisory, x_refsource_APPLE
http://www.redhat.com/support/errata/RHSA-2008-0580.html vendor-advisory, x_refsource_REDHAT
http://support.avaya.com/elmodocs2/security/ASA-2009-001.htm x_refsource_CONFIRM
http://secunia.com/advisories/34418 third-party-advisory, x_refsource_SECUNIA
http://www.vupen.com/english/advisories/2009/0904 vdb-entry, x_refsource_VUPEN
http://www.vupen.com/english/advisories/2009/0033 vdb-entry, x_refsource_VUPEN
http://www.securityfocus.com/archive/1/495319/100/0/threaded mailing-list, x_refsource_BUGTRAQ
http://www.securityfocus.com/archive/1/493353/100/0/threaded mailing-list, x_refsource_BUGTRAQ
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11109 vdb-entry, signature, x_refsource_OVAL
http://www.securityfocus.com/archive/1/502322/100/0/threaded mailing-list, x_refsource_BUGTRAQ
http://www.openwall.com/lists/oss-security/2008/06/16/2 mailing-list, x_refsource_MLIST
http://marc.info/?l=bugtraq&m=121494431426308&w=2 mailing-list, x_refsource_BUGTRAQ
http://www.vupen.com/english/advisories/2008/1851/references vdb-entry, x_refsource_VUPEN
http://support.avaya.com/elmodocs2/security/ASA-2008-457.htm x_refsource_CONFIRM
http://secunia.com/advisories/30731 third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/32222 third-party-advisory, x_refsource_SECUNIA
http://support.apple.com/kb/HT4077 x_refsource_CONFIRM
https://issues.rpath.com/browse/RPL-2622 x_refsource_CONFIRM
http://securityreason.com/securityalert/3951 third-party-advisory, x_refsource_SREASON
http://www.mandriva.com/security/advisories?name=MDVSA-2008:236 vendor-advisory, x_refsource_MANDRIVA
http://www.vupen.com/english/advisories/2008/2780 vdb-entry, x_refsource_VUPEN
http://www.openwall.com/lists/oss-security/2008/10/15/1 mailing-list, x_refsource_MLIST
http://secunia.com/advisories/32864 third-party-advisory, x_refsource_SECUNIA
http://www.securitytracker.com/id?1020293 vdb-entry, x_refsource_SECTRACK
http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html vendor-advisory, x_refsource_APPLE
http://support.apple.com/kb/HT3216 x_refsource_CONFIRM
http://www.securityfocus.com/bid/29715 vdb-entry, x_refsource_BID
http://wiki.rpath.com/Advisories:rPSA-2008-0247 x_refsource_CONFIRM
http://www.redhat.com/support/errata/RHSA-2008-0617.html vendor-advisory, x_refsource_REDHAT
http://www.securityfocus.com/archive/1/493352/100/0/threaded mailing-list, x_refsource_BUGTRAQ
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:14:14.550Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2009-0004.html"
          },
          {
            "name": "SUSE-SR:2009:007",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"
          },
          {
            "name": "RHSA-2008:0618",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0618.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.rdancer.org/vulnerablevim.html"
          },
          {
            "name": "USN-712-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-712-1"
          },
          {
            "name": "oval:org.mitre.oval:def:6238",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6238"
          },
          {
            "name": "31681",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/31681"
          },
          {
            "name": "vim-scripts-command-execution(43083)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43083"
          },
          {
            "name": "32858",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32858"
          },
          {
            "name": "33410",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33410"
          },
          {
            "name": "APPLE-SA-2010-03-29-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html"
          },
          {
            "name": "RHSA-2008:0580",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0580.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-001.htm"
          },
          {
            "name": "34418",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34418"
          },
          {
            "name": "ADV-2009-0904",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0904"
          },
          {
            "name": "ADV-2009-0033",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0033"
          },
          {
            "name": "20080811 rPSA-2008-0247-1 gvim vim vim-minimal",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/495319/100/0/threaded"
          },
          {
            "name": "20080614 Re: Collection of Vulnerabilities in Fully Patched Vim 7.1",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/493353/100/0/threaded"
          },
          {
            "name": "oval:org.mitre.oval:def:11109",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11109"
          },
          {
            "name": "20090401 VMSA-2009-0004 ESX Service Console updates for openssl, bind, and vim",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/502322/100/0/threaded"
          },
          {
            "name": "[oss-security] 20080616 CVE Id request: vim",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2008/06/16/2"
          },
          {
            "name": "20080701 Re: Collection of Vulnerabilities in Fully Patched Vim 7.1",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=121494431426308\u0026w=2"
          },
          {
            "name": "ADV-2008-1851",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/1851/references"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-457.htm"
          },
          {
            "name": "30731",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30731"
          },
          {
            "name": "32222",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32222"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT4077"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.rpath.com/browse/RPL-2622"
          },
          {
            "name": "3951",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/3951"
          },
          {
            "name": "MDVSA-2008:236",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:236"
          },
          {
            "name": "ADV-2008-2780",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/2780"
          },
          {
            "name": "[oss-security] 20081015 Vim CVE issues cleanup (plugins tar.vim, zip.vim) - CVE-2008-3074 and CVE-2008-3075",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2008/10/15/1"
          },
          {
            "name": "32864",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32864"
          },
          {
            "name": "1020293",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1020293"
          },
          {
            "name": "APPLE-SA-2008-10-09",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT3216"
          },
          {
            "name": "29715",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/29715"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://wiki.rpath.com/Advisories:rPSA-2008-0247"
          },
          {
            "name": "RHSA-2008:0617",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0617.html"
          },
          {
            "name": "20080613 Collection of Vulnerabilities in Fully Patched Vim 7.1",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/493352/100/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-06-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions, as demonstrated using (1) filetype.vim, (3) xpm.vim, (4) gzip_vim, and (5) netrw.  NOTE: the originally reported version was 7.1.314, but the researcher actually found this set of issues in 7.1.298.  NOTE: the zipplugin issue (originally vector 2 in this identifier) has been subsumed by CVE-2008-3075."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-11T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2009-0004.html"
        },
        {
          "name": "SUSE-SR:2009:007",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"
        },
        {
          "name": "RHSA-2008:0618",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0618.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.rdancer.org/vulnerablevim.html"
        },
        {
          "name": "USN-712-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-712-1"
        },
        {
          "name": "oval:org.mitre.oval:def:6238",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6238"
        },
        {
          "name": "31681",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/31681"
        },
        {
          "name": "vim-scripts-command-execution(43083)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43083"
        },
        {
          "name": "32858",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32858"
        },
        {
          "name": "33410",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33410"
        },
        {
          "name": "APPLE-SA-2010-03-29-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html"
        },
        {
          "name": "RHSA-2008:0580",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0580.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-001.htm"
        },
        {
          "name": "34418",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34418"
        },
        {
          "name": "ADV-2009-0904",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0904"
        },
        {
          "name": "ADV-2009-0033",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0033"
        },
        {
          "name": "20080811 rPSA-2008-0247-1 gvim vim vim-minimal",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/495319/100/0/threaded"
        },
        {
          "name": "20080614 Re: Collection of Vulnerabilities in Fully Patched Vim 7.1",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/493353/100/0/threaded"
        },
        {
          "name": "oval:org.mitre.oval:def:11109",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11109"
        },
        {
          "name": "20090401 VMSA-2009-0004 ESX Service Console updates for openssl, bind, and vim",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/502322/100/0/threaded"
        },
        {
          "name": "[oss-security] 20080616 CVE Id request: vim",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2008/06/16/2"
        },
        {
          "name": "20080701 Re: Collection of Vulnerabilities in Fully Patched Vim 7.1",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=121494431426308\u0026w=2"
        },
        {
          "name": "ADV-2008-1851",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/1851/references"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-457.htm"
        },
        {
          "name": "30731",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30731"
        },
        {
          "name": "32222",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32222"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT4077"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.rpath.com/browse/RPL-2622"
        },
        {
          "name": "3951",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/3951"
        },
        {
          "name": "MDVSA-2008:236",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:236"
        },
        {
          "name": "ADV-2008-2780",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/2780"
        },
        {
          "name": "[oss-security] 20081015 Vim CVE issues cleanup (plugins tar.vim, zip.vim) - CVE-2008-3074 and CVE-2008-3075",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2008/10/15/1"
        },
        {
          "name": "32864",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32864"
        },
        {
          "name": "1020293",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1020293"
        },
        {
          "name": "APPLE-SA-2008-10-09",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT3216"
        },
        {
          "name": "29715",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/29715"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://wiki.rpath.com/Advisories:rPSA-2008-0247"
        },
        {
          "name": "RHSA-2008:0617",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0617.html"
        },
        {
          "name": "20080613 Collection of Vulnerabilities in Fully Patched Vim 7.1",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/493352/100/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-2712",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions, as demonstrated using (1) filetype.vim, (3) xpm.vim, (4) gzip_vim, and (5) netrw.  NOTE: the originally reported version was 7.1.314, but the researcher actually found this set of issues in 7.1.298.  NOTE: the zipplugin issue (originally vector 2 in this identifier) has been subsumed by CVE-2008-3075."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2009-0004.html",
              "refsource": "CONFIRM",
              "url": "http://www.vmware.com/security/advisories/VMSA-2009-0004.html"
            },
            {
              "name": "SUSE-SR:2009:007",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"
            },
            {
              "name": "RHSA-2008:0618",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0618.html"
            },
            {
              "name": "http://www.rdancer.org/vulnerablevim.html",
              "refsource": "MISC",
              "url": "http://www.rdancer.org/vulnerablevim.html"
            },
            {
              "name": "USN-712-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-712-1"
            },
            {
              "name": "oval:org.mitre.oval:def:6238",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6238"
            },
            {
              "name": "31681",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/31681"
            },
            {
              "name": "vim-scripts-command-execution(43083)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43083"
            },
            {
              "name": "32858",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32858"
            },
            {
              "name": "33410",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33410"
            },
            {
              "name": "APPLE-SA-2010-03-29-1",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html"
            },
            {
              "name": "RHSA-2008:0580",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0580.html"
            },
            {
              "name": "http://support.avaya.com/elmodocs2/security/ASA-2009-001.htm",
              "refsource": "CONFIRM",
              "url": "http://support.avaya.com/elmodocs2/security/ASA-2009-001.htm"
            },
            {
              "name": "34418",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/34418"
            },
            {
              "name": "ADV-2009-0904",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0904"
            },
            {
              "name": "ADV-2009-0033",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0033"
            },
            {
              "name": "20080811 rPSA-2008-0247-1 gvim vim vim-minimal",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/495319/100/0/threaded"
            },
            {
              "name": "20080614 Re: Collection of Vulnerabilities in Fully Patched Vim 7.1",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/493353/100/0/threaded"
            },
            {
              "name": "oval:org.mitre.oval:def:11109",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11109"
            },
            {
              "name": "20090401 VMSA-2009-0004 ESX Service Console updates for openssl, bind, and vim",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/502322/100/0/threaded"
            },
            {
              "name": "[oss-security] 20080616 CVE Id request: vim",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2008/06/16/2"
            },
            {
              "name": "20080701 Re: Collection of Vulnerabilities in Fully Patched Vim 7.1",
              "refsource": "BUGTRAQ",
              "url": "http://marc.info/?l=bugtraq\u0026m=121494431426308\u0026w=2"
            },
            {
              "name": "ADV-2008-1851",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/1851/references"
            },
            {
              "name": "http://support.avaya.com/elmodocs2/security/ASA-2008-457.htm",
              "refsource": "CONFIRM",
              "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-457.htm"
            },
            {
              "name": "30731",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/30731"
            },
            {
              "name": "32222",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32222"
            },
            {
              "name": "http://support.apple.com/kb/HT4077",
              "refsource": "CONFIRM",
              "url": "http://support.apple.com/kb/HT4077"
            },
            {
              "name": "https://issues.rpath.com/browse/RPL-2622",
              "refsource": "CONFIRM",
              "url": "https://issues.rpath.com/browse/RPL-2622"
            },
            {
              "name": "3951",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/3951"
            },
            {
              "name": "MDVSA-2008:236",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:236"
            },
            {
              "name": "ADV-2008-2780",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/2780"
            },
            {
              "name": "[oss-security] 20081015 Vim CVE issues cleanup (plugins tar.vim, zip.vim) - CVE-2008-3074 and CVE-2008-3075",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2008/10/15/1"
            },
            {
              "name": "32864",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32864"
            },
            {
              "name": "1020293",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1020293"
            },
            {
              "name": "APPLE-SA-2008-10-09",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html"
            },
            {
              "name": "http://support.apple.com/kb/HT3216",
              "refsource": "CONFIRM",
              "url": "http://support.apple.com/kb/HT3216"
            },
            {
              "name": "29715",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/29715"
            },
            {
              "name": "http://wiki.rpath.com/Advisories:rPSA-2008-0247",
              "refsource": "CONFIRM",
              "url": "http://wiki.rpath.com/Advisories:rPSA-2008-0247"
            },
            {
              "name": "RHSA-2008:0617",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0617.html"
            },
            {
              "name": "20080613 Collection of Vulnerabilities in Fully Patched Vim 7.1",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/493352/100/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-2712",
    "datePublished": "2008-06-16T21:00:00.000Z",
    "dateReserved": "2008-06-16T00:00:00.000Z",
    "dateUpdated": "2024-08-07T09:14:14.550Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.