NVD

Id
2963  
Name
CVE-2008-3075  
Description
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a ZIP archive and possibly (2) the filename of the first file in a ZIP archive, which is not properly handled by zip.vim in the VIM ZIP plugin (zipPlugin.vim) v.11 through v.21, as demonstrated by the zipplugin and zipplugin.v2 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3074. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-03  
Published
2009-02-21  
Modified Date
2010-08-21  
Seq
2008-3075  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
18648 2963 CVE-2008-3075 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919  View
18649 2963 CVE-2008-3075 SUSE-SR:2009:007  View
18650 2963 CVE-2008-3075 20080701 Re: Collection of Vulnerabilities in Fully Patched Vim 7.1  View
18651 2963 CVE-2008-3075 oval:org.mitre.oval:def:10246  View
18652 2963 CVE-2008-3075 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324  View
18653 2963 CVE-2008-3075 MDVSA-2008:236  View
18654 2963 CVE-2008-3075 [oss-security] 20080707 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10  View
18655 2963 CVE-2008-3075 [oss-security] 20080707 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10  View
18656 2963 CVE-2008-3075 [oss-security] 20080708 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10  View
18657 2963 CVE-2008-3075 [oss-security] 20080710 Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10  View
18658 2963 CVE-2008-3075 [oss-security] 20080713 Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10  View
18659 2963 CVE-2008-3075 [oss-security] 20080715 Re: Re: More arbitrary code executions in Netrw  View
18660 2963 CVE-2008-3075 [oss-security] 20080731 Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10  View
18661 2963 CVE-2008-3075 [oss-security] 20081015 Vim CVE issues cleanup (plugins tar.vim, zip.vim) - CVE-2008-3074 and CVE-2008-3075  View
18662 2963 CVE-2008-3075 [oss-security] 20081020 CVE request (vim)  View
18663 2963 CVE-2008-3075 http://www.rdancer.org/vulnerablevim.html  View
18664 2963 CVE-2008-3075 RHSA-2008:0580  View
18665 2963 CVE-2008-3075 32463  View
18666 2963 CVE-2008-3075 https://bugzilla.redhat.com/show_bug.cgi?id=467432  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40100 JVNDB-2009-001106 Vim の shellescape 関数における ZIP アーカイブファイル名に関する任意のコードを実行される脆弱性 Vim の shellescape 関数には、ZIP アーカイブファイル名に関してシェルメタキャラクター "!" の処理に不備があるため、任意のコードを実行される脆弱性が存在します。 CVE-2008-3075 33188 CVE-2008-3075 2963 9.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001106.html 2009-02-21 2009-03-30 View