Описание
Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.
A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimball#RmVimball() function.
Отчет
This is an Important vulnerability in Vim where a crafted vimball can lead to arbitrary command execution. The flaw allows an attacker to embed malicious commands within a .VimballRecord file, which are then executed with user privileges during a later, unrelated vimball installation or removal. This extends the impact of processing untrusted vimball files beyond the initial installation.
Меры по смягчению последствий
Avoid installing or removing vimballs from untrusted sources. This vulnerability relies on a user processing a malicious vimball, which then injects commands that are executed during a subsequent vimball operation. Exercise caution when handling vimball files from unknown or unverified origins.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | vim | Affected | ||
| Red Hat Enterprise Linux 6 | vim | Affected | ||
| Red Hat Enterprise Linux 7 | vim | Affected | ||
| Red Hat Enterprise Linux 8 | vim | Affected | ||
| Red Hat Enterprise Linux 9 | vim | Affected | ||
| Red Hat Hardened Images | vim | Not affected | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.3 High
CVSS3
Связанные уязвимости
Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.
Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.
Vim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`
Vim is an open source, command line text editor. Prior to 9.2.0847, ru ...
EPSS
7.3 High
CVSS3