Vulnerability Description
vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vim | Vim | <= 8.0.0055 |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- http://openwall.com/lists/oss-security/2016/11/22/20PatchThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2972.html
- http://www.debian.org/security/2016/dsa-3722
- http://www.securityfocus.com/bid/94478
- http://www.securitytracker.com/id/1037338
- http://www.ubuntu.com/usn/USN-3139-1
- https://anonscm.debian.org/cgit/pkg-vim/vim.git/tree/debian/changelogPatchThird Party Advisory
- https://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba72795040PatchVendor Advisory
- https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39aPatchVendor Advisory
- https://github.com/vim/vim/releases/tag/v8.0.0056PatchVendor Advisory
- https://lists.debian.org/debian-lts-announce/2016/11/msg00025.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-security-announce/2016/msg00305.htmlThird Party Advisory
- https://security.gentoo.org/glsa/201701-29
- http://openwall.com/lists/oss-security/2016/11/22/20PatchThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2972.html
FAQ
What is CVE-2016-1248?
CVE-2016-1248 is a vulnerability with a CVSS score of 7.8 (HIGH). vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted mo...
How severe is CVE-2016-1248?
CVE-2016-1248 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-1248?
Check the references section above for vendor advisories and patch information. Affected products include: Vim Vim, Debian Debian Linux.