ALT-PU-2019-2040-1
Closed vulnerabilities
BDU:2019-03251
Уязвимость библиотеки getchar.c текстового редактора Vim, связанная с отсутствием мер по нейтрализации специальных элементов, используемых в команде операционной системы, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2022-05913
Уязвимость команды OS текстового редактора Vim, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2019-12735
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.
- openSUSE-SU-2019:1551
- openSUSE-SU-2019:1551
- openSUSE-SU-2019:1562
- openSUSE-SU-2019:1562
- openSUSE-SU-2019:1561
- openSUSE-SU-2019:1561
- openSUSE-SU-2019:1759
- openSUSE-SU-2019:1759
- openSUSE-SU-2019:1796
- openSUSE-SU-2019:1796
- openSUSE-SU-2019:1997
- openSUSE-SU-2019:1997
- 108724
- 108724
- RHSA-2019:1619
- RHSA-2019:1619
- RHSA-2019:1774
- RHSA-2019:1774
- RHSA-2019:1793
- RHSA-2019:1793
- RHSA-2019:1947
- RHSA-2019:1947
- https://bugs.debian.org/930020
- https://bugs.debian.org/930020
- https://bugs.debian.org/930024
- https://bugs.debian.org/930024
- https://github.com/neovim/neovim/pull/10082
- https://github.com/neovim/neovim/pull/10082
- https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md
- https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md
- https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040
- https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040
- [debian-lts-announce] 20190803 [SECURITY] [DLA 1871-1] vim security update
- [debian-lts-announce] 20190803 [SECURITY] [DLA 1871-1] vim security update
- FEDORA-2019-d79f89346c
- FEDORA-2019-d79f89346c
- FEDORA-2019-dcd49378b8
- FEDORA-2019-dcd49378b8
- 20190724 [SECURITY] [DSA 4487-1] neovim security update
- 20190724 [SECURITY] [DSA 4487-1] neovim security update
- 20190624 [SECURITY] [DSA 4467-2] vim regression update
- 20190624 [SECURITY] [DSA 4467-2] vim regression update
- GLSA-202003-04
- GLSA-202003-04
- https://support.f5.com/csp/article/K93144355
- https://support.f5.com/csp/article/K93144355
- https://support.f5.com/csp/article/K93144355?utm_source=f5support&%3Butm_medium=RSS
- https://support.f5.com/csp/article/K93144355?utm_source=f5support&%3Butm_medium=RSS
- USN-4016-1
- USN-4016-1
- USN-4016-2
- USN-4016-2
- DSA-4467
- DSA-4467
- DSA-4487
- DSA-4487
Modified: 2024-11-21
CVE-2019-20807
In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).
- openSUSE-SU-2020:0794
- openSUSE-SU-2020:0794
- 20200717 APPLE-SA-2020-07-15-2 macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
- 20200717 APPLE-SA-2020-07-15-2 macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
- https://github.com/vim/vim/commit/8c62a08faf89663e5633dc5036cd8695c80f1075
- https://github.com/vim/vim/commit/8c62a08faf89663e5633dc5036cd8695c80f1075
- https://github.com/vim/vim/releases/tag/v8.1.0881
- https://github.com/vim/vim/releases/tag/v8.1.0881
- [debian-lts-announce] 20220110 [SECURITY] [DLA 2876-1] vim security update
- [debian-lts-announce] 20220110 [SECURITY] [DLA 2876-1] vim security update
- https://support.apple.com/kb/HT211289
- https://support.apple.com/kb/HT211289
- USN-4582-1
- USN-4582-1
- https://www.starwindsoftware.com/security/sw-20220812-0003/
- https://www.starwindsoftware.com/security/sw-20220812-0003/
Closed bugs
CVE-2019-12735: Modelines allow arbitrary code execution