Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2004-1138

VIM before 6.3 and gVim before 6.3 allow local users to execute arbitrary commands via a file containing a crafted modeline that is executed when the file is viewed using options such as (1) termcap, (2) printdevice, (3) titleold, (4) filetype, (5) syntax, (6) backupext, (7) keymap, (8) patchmode, or (9) langmenu.

Published

2005-01-10T05:00:00.000

Last Modified

2025-04-03T01:03:51.193

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.2 (HIGH)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

3.9

Impact Score

10.0

Weaknesses
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application vim_development_group vim 5.0 Yes
Application vim_development_group vim 5.1 Yes
Application vim_development_group vim 5.2 Yes
Application vim_development_group vim 5.3 Yes
Application vim_development_group vim 5.4 Yes
Application vim_development_group vim 5.5 Yes
Application vim_development_group vim 5.6 Yes
Application vim_development_group vim 5.7 Yes
Application vim_development_group vim 5.8 Yes
Application vim_development_group vim 6.0 Yes
Application vim_development_group vim 6.1 Yes
Application vim_development_group vim 6.2 Yes
Application vim_development_group vim 6.3.011 Yes
Application vim_development_group vim 6.3.025 Yes
Application vim_development_group vim 6.3.030 Yes
Application vim_development_group vim 6.3.044 Yes
References