Description
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a tar archive and possibly (2) the filename of the first file in a tar archive, which is not properly handled by the VIM TAR plugin (tar.vim) v.10 through v.22, as demonstrated by the shellescape, tarplugin.v2, tarplugin, and tarplugin.updated test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3075. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | vim | 2:7.2.010-1 | — |
| Debian 13 | vim | 2:7.2.010-1 | — |
| Debian 12 | vim | 2:7.2.010-1 | — |
| Debian 4.0 | vim | 1:7.0-122+1etch5 | DSA-1733-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | vim +4 | 2:7.0.109-4.el5_2.4z | RHSA-2008:0580 |
Advisories 2
- RHSA-2008:0580 Red Hat Security Advisory: vim security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1733-1 vim - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- SUSE-SR:2009:007 vendor-advisory
- http://www.rdancer.org/vulnerablevim.html
- [oss-security] 20080715 Re: Re: More arbitrary code executions in Netrw mailing-list
- [oss-security] 20081020 CVE request (vim) mailing-list
- 32462 vdb-entry
- oval:org.mitre.oval:def:10754 vdb-entry signature
- [oss-security] 20080713 Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 mailing-list
- RHSA-2008:0580 vendor-advisory
- 34418 third-party-advisory
- [oss-security] 20080707 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 mailing-list
- [oss-security] 20080731 Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 mailing-list
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324
- 20080701 Re: Collection of Vulnerabilities in Fully Patched Vim 7.1 mailing-list
- [oss-security] 20080708 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 mailing-list
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919
- [oss-security] 20080710 Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 mailing-list
- [oss-security] 20080707 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 mailing-list
- http://www.rdancer.org/vulnerablevim-shellescape.html
- MDVSA-2008:236 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=467428
- [oss-security] 20081015 Vim CVE issues cleanup (plugins tar.vim, zip.vim) - CVE-2008-3074 and CVE-2008-3075 mailing-list