CVE-2008-3076

CRÍTICO 9.3CVE-2008-3076 · Published 21/02/2009 · updated 16/06/2026

En resumen

CVE-2008-3076 es una vulnerabilidad CRÍTICO (CVSS 9.3) que afecta a vim (vim).
Probabilidad de explotación en los próximos 30 días (EPSS): 9.0%, mayor que el 95.3% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
vim vim	`= 7.2a.10`	No fix yet

Description

The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.

References

bugs.debian.org/cgi-bin/bugreport.cgi
lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
marc.info
marc.info · Exploit
secunia.com/advisories/34418
wiki.rpath.com/wiki/Advisories:rPSA-2008-0324
mandriva.com/security/advisories
openwall.com/lists/oss-security/2008/07/07/1 · Exploit
openwall.com/lists/oss-security/2008/07/07/4 · Exploit
openwall.com/lists/oss-security/2008/07/08/12
openwall.com/lists/oss-security/2008/10/20/2
rdancer.org/vulnerablevim-netrw.html · Exploit
rdancer.org/vulnerablevim-netrw.v2.html · Exploit
redhat.com/support/errata/RHSA-2008-0580.html
securityfocus.com/bid/30115 · Exploit
exchange.xforce.ibmcloud.com/vulnerabilities/43624

Más vulnerabilidades de vim

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free