The VI Improved editor (vim) received bugfixes for some code execution problems.

  - Arbitrary code execution in vim helper plugins     filetype.vim, zipplugin, xpm.vim, gzip_vim, and netrw     were fixed. (CVE-2008-2712)

  - Arbitrary code execution when pressing K, ctrl-] or g]     depending on the text under the cursor. (CVE-2008-4101)

  - The netrw plugin sent credentials to all servers.
    (CVE-2008-4677)

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - autoload/netrw.vim別名 Netrw プラグイン109、131、および Vim 用の 133k より前のその他のバージョン 7.1.266、その他の 7.1 、および 7.2 は、FTP セッションの認証情報を保存し、後続の確立を試みる際にそれらの認証情報を送信します異なるホスト上のサーバーへの FTP セッション。これにより、リモート FTP サーバーが、ユーザー名およびパスワードを記録することで、状況次第で機密情報を取得することが可能です。注Upstream ベンダーは、同じホストの異なるポートを伴うベクトルには異議を申し立て、その変更されないホスト名で意図的に同じ ID とパスワードを使用していると仮定します。CVE-2008-4677

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Several vulnerabilities were found in the vim editor :

A number of input sanitization flaws were found in various vim system functions. If a user were to open a specially crafted file, it would be possible to execute arbitrary code as the user running vim (CVE-2008-2712).

Ulf H&Atilde;&curren;rnhammar of Secunia Research found a format string flaw in vim's help tags processor. If a user were tricked into executing the helptags command on malicious data, it could result in the execution of arbitrary code as the user running vim (CVE-2008-2953).

A flaw was found in how tar.vim handled TAR archive browsing. If a user were to open a special TAR archive using the plugin, it could result in the execution of arbitrary code as the user running vim (CVE-2008-3074).

A flaw was found in how zip.vim handled ZIP archive browsing. If a user were to open a special ZIP archive using the plugin, it could result in the execution of arbitrary code as the user running vim (CVE-2008-3075).

A number of security flaws were found in netrw.vim, the vim plugin that provides the ability to read and write files over the network. If a user opened a specially crafted file or directory with the netrw plugin, it could result in the execution of arbitrary code as the user running vim (CVE-2008-3076).

A number of input validation flaws were found in vim's keyword and tag handling. If vim looked up a document's maliciously crafted tag or keyword, it was possible to execute arbitary code as the user running vim (CVE-2008-4101).

A vulnerability was found in certain versions of netrw.vim where it would send FTP credentials stored for an FTP session to subsequent FTP sessions to servers on different hosts, exposing FTP credentials to remote hosts (CVE-2008-4677).

This update provides vim 7.2 (patchlevel 65) which corrects all of these issues and introduces a number of new features and bug fixes.

Update :

The previous vim update incorrectly introduced a requirement on libruby and also conflicted with a file from the git-core package (in contribs). These issues have been corrected with these updated packages.

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - autoload/netrw.vim又称为 Netrw 插件109、131 以及其他低于 133k 的其他版本用于 Vim 7.1.266、其他 7.1 版本以及 7.2 存储 FTP 会话的凭据并在尝试建立后续会话时发送这些凭据与不同主机上的服务器建立 FTP 会话从而允许远程 FTP 服务器通过记录用户名和密码有机会时获取敏感信息。注意上游供应商对涉及同一主机上不同端口的矢量提出争议称其为“我假设他们故意在该未更改的主机名上使用相同的 ID 和密码”。 (CVE-2008-4677)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - autoload/netrw.vim (即 Netrw 外掛程式) 109、131 和 133k 之前的其他版本 Vim 7.1.266、其他 7.1 版本和 7.2 儲存 FTP 工作階段的認證並在嘗試建立後續FTP 工作階段連線至不同主機上的伺服器其允許遠端 FTP 伺服器透過記錄使用者名稱和密碼有機會取得敏感資訊。注意上游供應商對涉及相同主機上不同連接埠的向量有爭議指出他們刻意假設他們在未變更的主機名稱上使用相同的 ID 和密碼。 (CVE-2008-4677)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other     7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting     to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to     obtain sensitive information in opportunistic circumstances by logging usernames and passwords. NOTE: the     upstream vendor disputes a vector involving different ports on the same host, stating I'm assuming that     they're using the same id and password on that unchanged hostname, deliberately. (CVE-2008-4677)

Note that Nessus relies on the presence of the package as reported by the vendor.

The VI Improved editor (vim) was updated to version 7.2.108 to fix various security problems and other bugs.

CVE-2008-4677: The netrw plugin sent credentials to all servers.
CVE-2009-0316: The python support used a search path including the current directory, allowing code injection when python code was used.
CVE-2008-2712: Arbitrary code execution in vim helper plugins filetype.vim, zipplugin, xpm.vim, gzip_vim, and netrw were fixed.
CVE-2008-3074: tarplugin code injection CVE-2008-3075: zipplugin code injection CVE-2008-3076: several netrw bugs, code injection CVE-2008-6235: code injection in the netrw plugin CVE-2008-4677:
credential disclosure by netrw plugin

ID	Name	Product	Family	Published	Updated	Severity
41283	SuSE9 Security Update : ViM (YOU Patch Number 12360)	Nessus	SuSE Local Security Checks	9/24/2009	1/14/2021	high
254127	Linux Distros のパッチ未適用の脆弱性: CVE-2008-4677	Nessus	Misc.	8/24/2025	8/24/2025	high
36821	Mandriva Linux Security Advisory : vim (MDVSA-2008:236-1)	Nessus	Mandriva Local Security Checks	4/23/2009	1/6/2021	high
254127	Linux Distros 未修补的漏洞：CVE-2008-4677	Nessus	Misc.	8/24/2025	8/24/2025	high
254127	Linux Distros 未修補的弱點：CVE-2008-4677	Nessus	Misc.	8/24/2025	8/24/2025	high
254127	Linux Distros Unpatched Vulnerability : CVE-2008-4677	Nessus	Misc.	8/24/2025	8/24/2025	high
35921	openSUSE 10 Security Update : gvim (gvim-6023)	Nessus	SuSE Local Security Checks	3/13/2009	1/14/2021	high
39980	openSUSE Security Update : gvim (gvim-561)	Nessus	SuSE Local Security Checks	7/21/2009	1/14/2021	high
40230	openSUSE Security Update : gvim (gvim-561)	Nessus	SuSE Local Security Checks	7/21/2009	1/14/2021	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high