An update of the vim package has been released.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - vim: Integer overflow at an unserialize_uep memory allocation site (CVE-2017-6350)

  - VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file     ([ORIGINAL_FILENAME].swp) resulting in files that may be world readable or otherwise accessible in ways     not intended by the user running the vi binary. (CVE-2017-1000382)

  - Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other     impact via a crafted source (aka -S) file. NOTE: there might be a limited number of scenarios in which     this has security relevance. (CVE-2017-11109)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - vim: Integer overflow at an unserialize_uep memory allocation site (CVE-2017-6350)

  - Untrusted search path vulnerability in src/if_python.c in the Python interface in Vim before 7.2.045     allows local users to execute arbitrary code via a Trojan horse Python file in the current working     directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983), as demonstrated by an     erroneous search path for plugin/bike.vim in bicyclerepair. (CVE-2009-0316)

  - vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap'     options, which may result in the execution of arbitrary code if a file with a specially crafted modeline     is opened. (CVE-2016-1248)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - vim: Integer overflow at an unserialize_uep memory allocation site (CVE-2017-6350)

  - VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file     ([ORIGINAL_FILENAME].swp) resulting in files that may be world readable or otherwise accessible in ways     not intended by the user running the vi binary. (CVE-2017-1000382)

  - Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other     impact via a crafted source (aka -S) file. NOTE: there might be a limited number of scenarios in which     this has security relevance. (CVE-2017-11109)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
121973	Photon OS 2.0: Vim PHSA-2018-2.0-0076	Nessus	PhotonOS Local Security Checks	2/7/2019	7/22/2024	medium
198572	RHEL 6 : vim (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	10/8/2024	critical
198547	RHEL 5 : vim (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	10/8/2024	critical
196374	RHEL 7 : vim (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	5/11/2024	5/31/2024	critical
121867	Photon OS 1.0: Vim PHSA-2018-1.0-0167	Nessus	PhotonOS Local Security Checks	2/7/2019	5/24/2022	medium
198506	RHEL 7 : vim (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	10/8/2024	critical
196373	RHEL 5 : vim (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	5/11/2024	5/31/2024	critical
196324	RHEL 6 : vim (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	5/11/2024	5/31/2024	critical

Detections

Analytics

Plugins Search

medium

critical

critical

critical

medium

critical

critical

critical