SB2020052815 - OS Command Injection in Vim Vim
Published: May 28, 2020 Updated: July 17, 2020
Security Bulletin ID
SB2020052815
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) OS Command Injection (CVE-ID: CVE-2019-20807)
The vulnerability allows a local authenticated user to read and manipulate data.
In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).
Remediation
Install update from vendor's website.