Description
VIM before 6.3 and gVim before 6.3 allow local users to execute arbitrary commands via a file containing a crafted modeline that is executed when the file is viewed using options such as (1) termcap, (2) printdevice, (3) titleold, (4) filetype, (5) syntax, (6) backupext, (7) keymap, (8) patchmode, or (9) langmenu.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | vim | 1:6.3-046+0sarge1 | — |
| Debian 13 | vim | 1:6.3-046+0sarge1 | — |
| Debian 12 | vim | 1:6.3-046+0sarge1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | vim +4 | 1:6.3.046-0.40E.4 | RHSA-2005:036 |
| RHEL 3 | vim +4 | 1:6.3.046-0.30E.1 | RHSA-2005:010 |
Advisories 2
- RHSA-2005:036 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:010 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- OpenPKG-SA-2004.052 vendor-advisory
- GLSA-200412-10 vendor-advisory
- vim-modeline-gain-privileges(18503) vdb-entry
- FLSA:2343 vendor-advisory
- RHSA-2005:036 vendor-advisory
- RHSA-2005:010 vendor-advisory
- oval:org.mitre.oval:def:9571 vdb-entry signature