CVE-2002-1377
- State
- Published
- Severity
- Not scored
- Published
- Sep 1, 2004
- Updated
- Aug 8, 2024
- Reserved
- Dec 16, 2002
Description
vim 6.0 and 6.1, and possibly other versions, allows attackers to execute arbitrary commands using the libcall feature in modelines, which are not sandboxed but may be executed when vim is used to edit a malicious file, as demonstrated using mutt.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 6384vdb-entry
- RHSA-2002:302vendor-advisory
- http://www.guninski.com/vim1.html
- 20021213 Some vim problems, yet still vim much better than windowsmailing-list
- RHSA-2002:297vendor-advisory
- 55700vendor-advisory
- CLA-2004:812vendor-advisory
- MDKSA-2003:012vendor-advisory
- 20040331 OpenLinux: vim arbitrary commands execution through modelinesmailing-list
- vim-modeline-command-execution(10835)vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.