CVE-2016-1248
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 25%
exploitation probability
25%top 2% of all CVEs
observed exploitation
nono source reports it
vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.
Affected products
n/a · vim before patch 8.0.0056References
http://openwall.com/lists/oss-security/2016/11/22/20http://rhn.redhat.com/errata/RHSA-2016-2972.htmlhttps://anonscm.debian.org/cgit/pkg-vim/vim.git/tree/debian/changeloghttps://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba72795040https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39ahttps://github.com/vim/vim/releases/tag/v8.0.0056https://lists.debian.org/debian-lts-announce/2016/11/msg00025.htmlhttps://lists.debian.org/debian-security-announce/2016/msg00305.htmlhttps://security.gentoo.org/glsa/201701-29http://www.debian.org/security/2016/dsa-3722http://www.securityfocus.com/bid/94478http://www.securitytracker.com/id/1037338