Vulnerability Description
Syntastic (aka vim-syntastic) through 3.9.0 does not properly handle searches for configuration files (it searches the current directory up to potentially the root). This improper handling might be exploited for arbitrary code execution via a malicious gcc plugin, if an attacker has write access to a directory that is a parent of the base directory of the project being checked. NOTE: exploitation is more difficult after 3.8.0 because filename prediction may be needed.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Syntastic Project | Syntastic | <= 3.9.0 |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- https://bugs.debian.org/894736ExploitIssue TrackingThird Party Advisory
- https://github.com/vim-syntastic/syntastic/commit/6d7c0b394e001233dd09ec473fbea2PatchThird Party Advisory
- https://github.com/vim-syntastic/syntastic/issues/2170ExploitIssue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/07/msg00036.htmlMailing ListThird Party Advisory
- https://www.debian.org/security/2018/dsa-4261Third Party Advisory
- https://bugs.debian.org/894736ExploitIssue TrackingThird Party Advisory
- https://github.com/vim-syntastic/syntastic/commit/6d7c0b394e001233dd09ec473fbea2PatchThird Party Advisory
- https://github.com/vim-syntastic/syntastic/issues/2170ExploitIssue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/07/msg00036.htmlMailing ListThird Party Advisory
- https://www.debian.org/security/2018/dsa-4261Third Party Advisory
FAQ
What is CVE-2018-11319?
CVE-2018-11319 is a vulnerability with a CVSS score of 7.5 (HIGH). Syntastic (aka vim-syntastic) through 3.9.0 does not properly handle searches for configuration files (it searches the current directory up to potentially the root). This improper handling might be ex...
How severe is CVE-2018-11319?
CVE-2018-11319 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-11319?
Check the references section above for vendor advisories and patch information. Affected products include: Syntastic Project Syntastic, Debian Debian Linux.