CVE-2009-0316

CVE	CVE-2009-0316
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2009-01-28 11:30:00 UTC
Updated	2017-08-08 01:33:00 UTC
Description	Untrusted search path vulnerability in src/if_python.c in the Python interface in Vim before 7.2.045 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983), as demonstrated by an erroneous search path for plugin/bike.vim in bicyclerepair.

Problem Types: NVD-CWE-Other

Type	Vendor	Product	Version	Update	Edition	Language
Application	Vim	Vim	1.0	All	All	All
Application	Vim	Vim	1.22	All	All	All
Application	Vim	Vim	3.0	All	All	All
Application	Vim	Vim	4.0	All	All	All
Application	Vim	Vim	5.0	All	All	All
Application	Vim	Vim	5.1	All	All	All
Application	Vim	Vim	5.2	All	All	All
Application	Vim	Vim	5.3	All	All	All
Application	Vim	Vim	5.4	All	All	All
Application	Vim	Vim	5.5	All	All	All
Application	Vim	Vim	5.6	All	All	All
Application	Vim	Vim	5.7	All	All	All
Application	Vim	Vim	5.8	All	All	All
Application	Vim	Vim	6.0	All	All	All
Application	Vim	Vim	6.1	All	All	All
Application	Vim	Vim	6.2	All	All	All
Application	Vim	Vim	6.3	All	All	All
Application	Vim	Vim	6.4	All	All	All
Application	Vim	Vim	7.0	All	All	All
Application	Vim	Vim	7.1	All	All	All
Application	Vim	Vim	1.0	All	All	All
Application	Vim	Vim	1.22	All	All	All
Application	Vim	Vim	3.0	All	All	All
Application	Vim	Vim	4.0	All	All	All
Application	Vim	Vim	5.0	All	All	All
Application	Vim	Vim	5.1	All	All	All
Application	Vim	Vim	5.2	All	All	All
Application	Vim	Vim	5.3	All	All	All
Application	Vim	Vim	5.4	All	All	All
Application	Vim	Vim	5.5	All	All	All
Application	Vim	Vim	5.6	All	All	All
Application	Vim	Vim	5.7	All	All	All
Application	Vim	Vim	5.8	All	All	All
Application	Vim	Vim	6.0	All	All	All
Application	Vim	Vim	6.1	All	All	All
Application	Vim	Vim	6.2	All	All	All
Application	Vim	Vim	6.3	All	All	All
Application	Vim	Vim	6.4	All	All	All
Application	Vim	Vim	7.0	All	All	All
Application	Vim	Vim	7.1	All	All	All
Application	Vim	Vim	All	All	All	All

Reference	Source	Link	Tags
#493937 - bicyclerepair: bike.vim imports untrusted python files from cwd - Debian Bug report logs	CONFIRM	bugs.debian.org
Support / Security / Advisories / / MDVSA-2009:047 \| Mandriva	MANDRIVA	www.mandriva.com
IBM X-Force Exchange	XF	exchange.xforce.ibmcloud.com
oss-security - CVE request -- Python < 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)	MLIST	www.openwall.com
Bug 481565 – CVE-2009-0316 vim: untrusted python modules search path	CONFIRM	bugzilla.redhat.com
APPLE-SA-2010-03-29-1 Security Update 2010-002 / Mac OS X v10.6.3	APPLE	lists.apple.com
Old Nabble - debian-bugs-rc - Bug#484305: bicyclerepair: bike.vim imports untrusted python files from cwd	MLIST	www.nabble.com
#484305 - bicyclerepair: bike.vim imports untrusted python files from cwd - Debian Bug report logs	MISC	bugs.debian.org
Vim 'PySys_SetArgv' Remote Command Execution Vulnerability	BID	www.securityfocus.com
About the security content of Security Update 2010-002 / Mac OS X v10.6.3	CONFIRM	support.apple.com
svn.pardus.org.tr/pardus/2008/applications/editors/vim/files/official/7.2.045	CONFIRM	svn.pardus.org.tr
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.