medium5.3
CVE-2019-20807
In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).
Impact
In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vim | Vim | before 8.1.0881 |
| Debian | Debian Linux | Version 9.0 |
| Opensuse | Leap | Version 15.1 |
| Canonical | Ubuntu Linux | Versions 16.04, 18.04 |
| Apple | Mac Os X | Versions 10.13.6, 10.14.6 |
| Starwindsoftware | Command Center | Version 2 |
| Starwindsoftware | San \& Nas | Version 1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00018.html
- http://seclists.org/fulldisclosure/2020/Jul/24
- https://github.com/vim/vim/commit/8c62a08faf89663e5633dc5036cd8695c80f1075
- https://github.com/vim/vim/releases/tag/v8.1.0881
- https://lists.debian.org/debian-lts-announce/2022/01/msg00003.html
- https://support.apple.com/kb/HT211289
- https://usn.ubuntu.com/4582-1/
- https://www.starwindsoftware.com/security/sw-20220812-0003/
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00018.html
- http://seclists.org/fulldisclosure/2020/Jul/24
- https://github.com/vim/vim/commit/8c62a08faf89663e5633dc5036cd8695c80f1075
- https://github.com/vim/vim/releases/tag/v8.1.0881
- https://lists.debian.org/debian-lts-announce/2022/01/msg00003.html
- https://support.apple.com/kb/HT211289
- https://usn.ubuntu.com/4582-1/
- https://www.starwindsoftware.com/security/sw-20220812-0003/