Debian Vim vulnerabilities

CVE-2019-12735 [HIGH] CVE-2019-12735: neovim - getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers... getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim. Scope: local bookworm: resolved (fixed in 0.3.4-3) bullseye: resolved (fixed in 0.3.4-3) forky: resolved (fixed in 0.3.4-3) sid: resolved

CVE-2016-1248 [HIGH] CVE-2016-1248: neovim - vim before patch 8.0.0056 does not properly validate values for the 'filetype', ... vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened. Scope: local bookworm: resolved (fixed in 0.1.6-4) bullseye: resolved (fixed in 0.1.6-4) forky: resolved (fixed in 0.1.6-4) sid: resolved (fixed in 0.1.6

CVE-2008-2712 [CRITICAL] CVE-2008-2712: vim - Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to ex... Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions, as demonstrated using (1) filetype.vim, (3) xpm.vim, (4) gzip_vim, and (5) netrw. NOTE: the originally reported version was 7.1.314, but the researcher actually fo

CVE-2008-3076 [CRITICAL] CVE-2008-3076: vim - The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers ... The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. Scope:

CVE-2008-4101 [CRITICAL] CVE-2008-4101: vim - Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which al... Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) execute arbitrary shell commands by entering a K keystroke on a line that contains a ";" (semicolon) followed by a command, or execute arbitrary Ex commands by entering an argument after a (2) "Ctrl-]" (control close-square-bracket) or (3) "g]" (g close-

CVE-2022-0572 [HIGH] CVE-2022-0572: vim - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Scope: local bookworm: resolved (fixed in 2:8.2.4659-1) bullseye: resolved (fixed in 2:8.2.2434-3+deb11u2) forky: resolved (fixed in 2:8.2.4659-1) sid: resolved (fixed in 2:8.2.4659-1) trixie: resolved (fixed in 2:8.2.4659-1)

CVE-2025-27423 [HIGH] CVE-2025-27423: vim - Vim is an open source, command line text editor. Vim is distributed with the tar... Vim is an open source, command line text editor. Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. Starting with 9.1.0858, the tar.vim plugin uses the ":read" ex command line to append below the cursor position, however the is not sanitized and is taken literally from the tar archive. This allows

CVE-2020-20703 [CRITICAL] CVE-2020-20703: vim - Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to exec... Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the operand parameter. Scope: local bookworm: resolved (fixed in 2:8.1.2136-1) bullseye: resolved (fixed in 2:8.1.2136-1) forky: resolved (fixed in 2:8.1.2136-1) sid: resolved (fixed in 2:8.1.2136-1) trixie: resolved (fixed in 2:8.1.2136-1)

CVE-2026-28417 [MEDIUM] CVE-2026-28417: vim - Vim is an open source, command line text editor. Prior to version 9.2.0073, an O... Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes th

CVE-2026-34714 [CRITICAL] CVE-2026-34714: vim - Vim before 9.2.0272 allows code execution that happens immediately upon opening ... Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE. Scope: local bookworm: resolved bullseye: resolved forky: open sid: resolved (fixed in 2:9.2.0315-1) trixie: resolved

CVE-2022-0318 [CRITICAL] CVE-2022-0318: vim - Heap-based Buffer Overflow in vim/vim prior to 8.2. Heap-based Buffer Overflow in vim/vim prior to 8.2. Scope: local bookworm: resolved (fixed in 2:8.2.4659-1) bullseye: open forky: resolved (fixed in 2:8.2.4659-1) sid: resolved (fixed in 2:8.2.4659-1) trixie: resolved (fixed in 2:8.2.4659-1)

CVE-2026-34982 [HIGH] CVE-2026-34982: vim - Vim is an open source, command line text editor. Prior to version 9.2.0276, a mo... Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when a user opens a crafted file. The `complete`, `guitabtooltip` and `printheader` options are missing the `P_MLE` flag, allowing a modeline to be executed. Additionally, the `mapset()` function lacks a `check_secure()` call

CVE-2026-33412 [MEDIUM] CVE-2026-33412: vim - Vim is an open source, command line text editor. Prior to version 9.2.0202, a co... Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may be able to execute arbitrary shell commands. This vulnerability depends on the user's 'shell' setting. This issue has bee

CVE-2008-6235 [CRITICAL] CVE-2008-6235: vim - The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers t... The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrw_curdir variable, as demonstrated using the netrw.v4 and netrw.v5 test cases. Scope: local bookworm: resolved (fixed in 2:7.2.148-1) bullseye: resolved (fixed in 2:7.2.148

CVE-2017-5953 [CRITICAL] CVE-2017-5953: neovim - vim before patch 8.0.0322 does not properly validate values for tree length when... vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow. Scope: local bookworm: resolved (fixed in 0.1.7-4) bullseye: resolved (fixed in 0.1.7-4) forky: resolved (fixed in 0.1.7-4) sid: resolved (fixed in 0.1.7-4) trixi

CVE-2017-6350 [CRITICAL] CVE-2017-6350: neovim - An integer overflow at an unserialize_uep memory allocation site would occur for... An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows. Scope: local bookworm: resolved (fixed in 0.1.7-4) bullseye: resolved (fixed in 0.1.7-4) forky: resolved (fixed in 0.1.7-

CVE-2022-0729 [HIGH] CVE-2022-0729: vim - Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.444... Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Scope: local bookworm: resolved (fixed in 2:8.2.4659-1) bullseye: open forky: resolved (fixed in 2:8.2.4659-1) sid: resolved (fixed in 2:8.2.4659-1) trixie: resolved (fixed in 2:8.2.4659-1)

CVE-2017-6349 [CRITICAL] CVE-2017-6349: neovim - An integer overflow at a u_read_undo memory allocation site would occur for vim ... An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows. Scope: local bookworm: resolved (fixed in 0.1.7-4) bullseye: resolved (fixed in 0.1.7-4) forky: resolved (fixed in 0.1.7-4) si

CVE-2022-1381 [HIGH] CVE-2022-1381: vim - global heap buffer overflow in skip_range in GitHub repository vim/vim prior to ... global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution Scope: local bookworm: resolved (fixed in 2:8.2.4793-1) bullseye: resolved forky: resolved (fixed in 2:8.2.4793-1) sid: resolved (fixed in 2:8.2.4793-1) trixi

CVE-2008-3075 [CRITICAL] CVE-2008-3075: vim - The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-... The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a ZIP archive and possibly (2) the filename of the first file in a ZIP archive, which is not properly handled by zip.vim in the VIM ZIP plugin (zipPlugin.vim) v.11 throug