CVE-2008-3076

The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:C/I:C/A:C
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 93%
VendorProductVersion
vimvim
7.2a.10:a.10
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
vim
bullseye
2:8.2.2434-3+deb11u1
fixed
bookworm
2:9.0.1378-2
fixed
sid
2:9.1.0777-1
fixed
trixie
2:9.1.0777-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
vim
intrepid
not-affected
hardy
not-affected
gutsy
not-affected
dapper
not-affected
Common Weakness Enumeration
References
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
http://marc.info/?l=bugtraq&m=121494431426308&w=2
http://marc.info/?l=oss-security&m=122416184431388&w=2
http://secunia.com/advisories/34418
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324
http://www.mandriva.com/security/advisories?name=MDVSA-2008:236
http://www.openwall.com/lists/oss-security/2008/07/07/1
http://www.openwall.com/lists/oss-security/2008/07/07/4
http://www.openwall.com/lists/oss-security/2008/07/08/12
http://www.openwall.com/lists/oss-security/2008/10/20/2
http://www.rdancer.org/vulnerablevim-netrw.html
http://www.rdancer.org/vulnerablevim-netrw.v2.html
http://www.redhat.com/support/errata/RHSA-2008-0580.html
http://www.securityfocus.com/bid/30115
https://exchange.xforce.ibmcloud.com/vulnerabilities/43624
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
http://marc.info/?l=bugtraq&m=121494431426308&w=2
http://marc.info/?l=oss-security&m=122416184431388&w=2
http://secunia.com/advisories/34418
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324
http://www.mandriva.com/security/advisories?name=MDVSA-2008:236
http://www.openwall.com/lists/oss-security/2008/07/07/1
http://www.openwall.com/lists/oss-security/2008/07/07/4
http://www.openwall.com/lists/oss-security/2008/07/08/12
http://www.openwall.com/lists/oss-security/2008/10/20/2
http://www.rdancer.org/vulnerablevim-netrw.html
http://www.rdancer.org/vulnerablevim-netrw.v2.html
http://www.redhat.com/support/errata/RHSA-2008-0580.html
http://www.securityfocus.com/bid/30115
https://exchange.xforce.ibmcloud.com/vulnerabilities/43624