Описание
Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needs-triage | |
| esm-infra-legacy/trusty | released | 2:7.4.052-1ubuntu3.1+esm31 |
| esm-infra-legacy/xenial | released | 2:7.4.1689-3ubuntu1.5+esm37 |
| esm-infra/bionic | released | 2:8.0.1453-1ubuntu1.13+esm22 |
| esm-infra/focal | released | 2:8.1.2269-1ubuntu5.32+esm10 |
| jammy | released | 2:8.2.3995-1ubuntu2.34 |
| noble | released | 2:9.1.0016-1ubuntu7.18 |
| resolute | released | 2:9.1.2141-1ubuntu4.7 |
| upstream | released | 2:9.2.0782-1 |
Показывать по
EPSS
7.8 High
CVSS3
Связанные уязвимости
Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.
Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.
Vim is an open source, command line text editor. Prior to 9.2.0735, th ...
EPSS
7.8 High
CVSS3