NVD

Id
54605  
Name
CVE-2007-2438  
Description
The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which might allow user-assisted attackers to execute shell commands and write files via modelines.  
Reject
 
CVSS Version
2  
CVSS Score
7.6  
Severity
High  
CVSS Base Score
7.6  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2007-05-02  
Modified Date
2012-10-30  
Seq
2007-2438  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
276920 54605 CVE-2007-2438 20070513 OMG VIM VULN  View
276921 54605 CVE-2007-2438 [vim-dev] 20070426 feedkeys() allowed in sandbox  View
276922 54605 CVE-2007-2438 [vim-dev] 20070428 Re: feedkeys() allowed in sandbox  View
276923 54605 CVE-2007-2438 oval:org.mitre.oval:def:9876  View
276924 54605 CVE-2007-2438 [vimannounce] 20070512 Stable Vim version 7.1 has been released  View
276925 54605 CVE-2007-2438 http://tech.groups.yahoo.com/group/vimdev/message/46627  View
276926 54605 CVE-2007-2438 http://tech.groups.yahoo.com/group/vimdev/message/46645  View
276927 54605 CVE-2007-2438 http://tech.groups.yahoo.com/group/vimdev/message/46658  View
276928 54605 CVE-2007-2438 20070823 vim editor duplicates / clarifications  View
276929 54605 CVE-2007-2438 DSA-1364  View
276930 54605 CVE-2007-2438 MDKSA-2007:101  View
276931 54605 CVE-2007-2438 SUSE-SR:2007:012  View
276932 54605 CVE-2007-2438 RHSA-2007:0346  View
276933 54605 CVE-2007-2438 20070430 FLEA-2007-0014-1: vim  View
276934 54605 CVE-2007-2438 23725  View
276935 54605 CVE-2007-2438 1018035  View
276936 54605 CVE-2007-2438 2007-0017  View
276937 54605 CVE-2007-2438 USN-463-1  View
276938 54605 CVE-2007-2438 http://www.vim.org/news/news.php  View
276939 54605 CVE-2007-2438 ADV-2007-1599  View
276940 54605 CVE-2007-2438 vim-feedkeyswritefile-command-execution(34012)  View
276941 54605 CVE-2007-2438 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=238259  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
51706 JVNDB-2007-000369 VIM の modelines 機能における任意のコマンドを実行される脆弱性 VIM の modelines 機能を通して、writefile() 関数、feedkeys() 関数、及び system() 関数を実行するような細工されたファイルを開くことで任意のコマンドを実行される脆弱性が存在します。 CVE-2007-2438 25793 CVE-2007-2438 54605 9.3 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-000369.html 2007-05-02 2007-05-30 View