Skip to content
OpenAdvisories
Unscored USN-4582-1 2 CVEs

vim vulnerabilities

Published Oct 14, 2020 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Vim incorrectly handled permissions on the .swp
file. A local attacker could possibly use this issue to obtain sensitive
information. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-17087)

It was discovered that Vim incorrectly handled restricted mode. A local
attacker could possibly use this issue to bypass restricted mode and
execute arbitrary commands. Note: This update only makes executing shell
commands more difficult. Restricted mode should not be considered a
complete security measure. (CVE-2019-20807)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS vim 2:7.4.1689-3ubuntu1.5
Ubuntu · 18.04 LTS 18.04:LTS vim 2:8.0.1453-1ubuntu1.4

Vulnerabilities 2

  • Unscored —
    CVE-2017-17087

    fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be d…

    vim vim Debian Ubuntu
  • Unscored —
    CVE-2019-20807

    In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting i…

    vim vim Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2017-17087
  • report
    https://ubuntu.com/security/CVE-2019-20807