3.7

CVE-2008-3294

src/configure.in in Vim 5.0 through 7.1, when used for a build with Python support, does not ensure that the Makefile-conf temporary file has the intended ownership and permissions, which allows local users to execute arbitrary code by modifying this file during a time window, or by creating it ahead of time with permissions that prevent its modification by configure.

Data is provided by the National Vulnerability Database (NVD)
Vim ≫ Vim Version5.0
Vim ≫ Vim Version5.1
Vim ≫ Vim Version5.2
Vim ≫ Vim Version5.3
Vim ≫ Vim Version5.4
Vim ≫ Vim Version5.5
Vim ≫ Vim Version5.6
Vim ≫ Vim Version5.7
Vim ≫ Vim Version5.8
Vim ≫ Vim Version6.0
Vim ≫ Vim Version6.1
Vim ≫ Vim Version6.2
Vim ≫ Vim Version6.3
Vim ≫ Vim Version6.4
Vim ≫ Vim Version7.0
Vim ≫ Vim Version7.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.13% 0.295
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 3.7 1.9 6.4
AV:L/AC:H/Au:N/C:P/I:P/A:P
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.