Description
Format string vulnerability in the helptags_one function in src/ex_cmds.c in Vim 6.4 and earlier, and 7.x up to 7.1, allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a help-tags tag in a help file, related to the helptags command.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | vim | 1:7.1-056+1 | — |
| Debian 13 | vim | 1:7.1-056+1 | — |
| Debian 12 | vim | 1:7.1-056+1 | — |
| Debian 4.0 | vim | 1:7.0-122+1etch3 | DSA-1364-2, DSA-1364-1 |
| Debian 3.1 | vim | 1:6.3-071+1sarge2 | DSA-1364-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | vim +4 | 2:7.0.109-4.el5_2.4z | RHSA-2008:0580 |
| RHEL 4 | vim +4 | 1:6.3.046-1.el4_7.5z | RHSA-2008:0617 |
| RHEL 3 | vim +4 | 1:6.3.046-0.30E.11 | RHSA-2008:0617 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | vim | 8.2.3408-1.2 | openSUSE-SU-2024:11497-1 |
Advisories 5
- RHSA-2008:0617 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0580 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1364-1 vim Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1364-2 vim - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11497-1 gvim-8.2.3408-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://www.vmware.com/security/advisories/VMSA-2009-0004.html
- 25095 vdb-entry
- 26822 third-party-advisory
- MDKSA-2007:168 vendor-advisory
- 26522 third-party-advisory
- 26285 third-party-advisory
- https://issues.rpath.com/browse/RPL-1595
- 26594 third-party-advisory
- 25941 third-party-advisory
- 32858 third-party-advisory
- 33410 third-party-advisory
- USN-505-1 vendor-advisory
- RHSA-2008:0580 vendor-advisory
- 20070730 FLEA-2007-0036-1 vim vim-minimal gvim mailing-list
- http://support.avaya.com/elmodocs2/security/ASA-2009-001.htm
- ADV-2007-2687 vdb-entry
- ADV-2009-0904 vdb-entry
- ADV-2009-0033 vdb-entry
- 20090401 VMSA-2009-0004 ESX Service Console updates for openssl, bind, and vim mailing-list
- oval:org.mitre.oval:def:6463 vdb-entry signature
- 2007-0026 vendor-advisory
- DSA-1364 vendor-advisory
- SUSE-SR:2007:018 vendor-advisory
- http://secunia.com/secunia_research/2007-66/advisory/
- 26653 third-party-advisory
- 20070823 vim editor duplicates / clarifications mailing-list
- oval:org.mitre.oval:def:11549 vdb-entry signature
- vim-helptagsone-code-execution(35655) vdb-entry
- MDVSA-2008:236 vendor-advisory
- 26674 third-party-advisory
- RHSA-2008:0617 vendor-advisory