Description
Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions, as demonstrated using (1) filetype.vim, (3) xpm.vim, (4) gzip_vim, and (5) netrw. NOTE: the originally reported version was 7.1.314, but the researcher actually found this set of issues in 7.1.298. NOTE: the zipplugin issue (originally vector 2 in this identifier) has been subsumed by CVE-2008-3075.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | vim | 1:7.1.314-3 | — |
| Debian 13 | vim | 1:7.1.314-3 | — |
| Debian 12 | vim | 1:7.1.314-3 | — |
| Debian 5.0 | vim | 1:7.1.293-3+lenny1 | DTSA-143-1 |
| Debian 4.0 | vim | 1:7.0-122+1etch5 | DSA-1733-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | vim +4 | 2:7.0.109-4.el5_2.4z | RHSA-2008:0580 |
| RHEL 4 | vim +4 | 1:6.3.046-1.el4_7.5z | RHSA-2008:0617 |
| RHEL 3 | vim +4 | 1:6.3.046-0.30E.11 | RHSA-2008:0617 |
| RHEL 2 | vim +4 | 1:6.0-7.25 | RHSA-2008:0618 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Vim 7.x - Vim Script Multiple Command Execution Vulnerabilities EDB-31911 · local · Jun 14, 2008
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- RHSA-2008:0618 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0617 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0580 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1733-1 vim - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-143-1 vim - filename escape vulnerability Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.vmware.com/security/advisories/VMSA-2009-0004.html
- SUSE-SR:2009:007 vendor-advisory
- RHSA-2008:0618 vendor-advisory
- http://www.rdancer.org/vulnerablevim.html
- USN-712-1 vendor-advisory
- oval:org.mitre.oval:def:6238 vdb-entry signature
- 31681 vdb-entry
- vim-scripts-command-execution(43083) vdb-entry
- 32858 third-party-advisory
- 33410 third-party-advisory
- APPLE-SA-2010-03-29-1 vendor-advisory
- RHSA-2008:0580 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2009-001.htm
- 34418 third-party-advisory
- ADV-2009-0904 vdb-entry
- ADV-2009-0033 vdb-entry
- 20080811 rPSA-2008-0247-1 gvim vim vim-minimal mailing-list
- 20080614 Re: Collection of Vulnerabilities in Fully Patched Vim 7.1 mailing-list
- oval:org.mitre.oval:def:11109 vdb-entry signature
- 20090401 VMSA-2009-0004 ESX Service Console updates for openssl, bind, and vim mailing-list
- [oss-security] 20080616 CVE Id request: vim mailing-list
- 20080701 Re: Collection of Vulnerabilities in Fully Patched Vim 7.1 mailing-list
- ADV-2008-1851 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2008-457.htm
- 30731 third-party-advisory
- 32222 third-party-advisory
- http://support.apple.com/kb/HT4077
- https://issues.rpath.com/browse/RPL-2622
- 3951 third-party-advisory
- MDVSA-2008:236 vendor-advisory
- ADV-2008-2780 vdb-entry
- [oss-security] 20081015 Vim CVE issues cleanup (plugins tar.vim, zip.vim) - CVE-2008-3074 and CVE-2008-3075 mailing-list
- 32864 third-party-advisory
- 1020293 vdb-entry
- APPLE-SA-2008-10-09 vendor-advisory
- http://support.apple.com/kb/HT3216
- 29715 vdb-entry
- http://wiki.rpath.com/Advisories:rPSA-2008-0247
- RHSA-2008:0617 vendor-advisory
- 20080613 Collection of Vulnerabilities in Fully Patched Vim 7.1 mailing-list