Description
The (1) tcltags or (2) vimspell.sh scripts in vim 6.3 allow local users to overwrite or create arbitrary files via a symlink attack on temporary files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | vim | 1:6.3-058+1 | — |
| Debian 13 | vim | 1:6.3-058+1 | — |
| Debian 12 | vim | 1:6.3-058+1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | vim +4 | 1:6.3.046-0.40E.4 | RHSA-2005:036 |
| RHEL 3 | vim +4 | 1:6.3.046-0.30E.3 | RHSA-2005:122 |
Advisories 2
- RHSA-2005:122 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:036 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 1012938 vdb-entry
- FLSA:2343 vendor-advisory
- 20050118 [USN-61-1] vim vulnerabilities mailing-list
- RHSA-2005:122 vendor-advisory
- oval:org.mitre.oval:def:9402 vdb-entry signature
- 13841 third-party-advisory
- vim-symlink(18870) vdb-entry
- RHSA-2005:036 vendor-advisory