Vulnerabilities > CVE-2009-0316 - Remote Command Execution vulnerability in Vim 'PySys_SetArgv'

CVSS 6.9 - MEDIUM

Attack vector

LOCAL

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

local

nessus

NVD

Published: 2009-01-28

Updated: 2017-08-08

Summary

Untrusted search path vulnerability in src/if_python.c in the Python interface in Vim before 7.2.045 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983), as demonstrated by an erroneous search path for plugin/bike.vim in bicyclerepair.

Vulnerable Configurations

Part	Description	Count
Application	Vim VIM VIM 1.0 VIM VIM 1.22 VIM VIM 3.0 VIM VIM 4.0 VIM VIM 5.0 VIM VIM 5.1 VIM VIM 5.2 VIM VIM 5.3 VIM VIM 5.4 VIM VIM 5.5 VIM VIM 5.6 VIM VIM 5.7 VIM VIM 5.8 VIM VIM 6.0 VIM VIM 6.1 VIM VIM 6.2 VIM VIM 6.3 VIM VIM 6.4 VIM VIM 7.0 VIM VIM 7.1 VIM VIM 7 VIM VIM 7.0.001 VIM VIM 7.0.002 VIM VIM 7.0.003 VIM VIM 7.0.004 VIM VIM 7.0.005 VIM VIM 7.0.006 VIM VIM 7.0.007 VIM VIM 7.0.008 VIM VIM 7.0.009 VIM VIM 7.0.010 VIM VIM 7.0.011 VIM VIM 7.0.012 VIM VIM 7.0.013 VIM VIM 7.0.014 VIM VIM 7.0.015 VIM VIM 7.0.016 VIM VIM 7.0.017 VIM VIM 7.0.018 VIM VIM 7.0.019 VIM VIM 7.0.020 VIM VIM 7.0.021 VIM VIM 7.0.022 VIM VIM 7.0.023 VIM VIM 7.0.024 VIM VIM 7.0.025 VIM VIM 7.0.026 VIM VIM 7.0.027 VIM VIM 7.0.028 VIM VIM 7.0.029 VIM VIM 7.0.030 VIM VIM 7.0.031 VIM VIM 7.0.032 VIM VIM 7.0.033 VIM VIM 7.0.034 VIM VIM 7.0.035 VIM VIM 7.0.036 VIM VIM 7.0.037 VIM VIM 7.0.038 VIM VIM 7.0.039 VIM VIM 7.0.040 VIM VIM 7.0.041 VIM VIM 7.0.042 VIM VIM 7.0.043 VIM VIM 7.0.044 VIM VIM 7.0.045 VIM VIM 7.0.046 VIM VIM 7.0.047 VIM VIM 7.0.048 VIM VIM 7.0.049 VIM VIM 7.0.050 VIM VIM 7.0.051 VIM VIM 7.0.052 VIM VIM 7.0.053 VIM VIM 7.0.054 VIM VIM 7.0.055 VIM VIM 7.0.056 VIM VIM 7.0.057 VIM VIM 7.0.058 VIM VIM 7.0.059 VIM VIM 7.0.060 VIM VIM 7.0.061 VIM VIM 7.0.062 VIM VIM 7.0.063 VIM VIM 7.0.064 VIM VIM 7.0.065 VIM VIM 7.0.066 VIM VIM 7.0.067 VIM VIM 7.0.068 VIM VIM 7.0.069 VIM VIM 7.0.070 VIM VIM 7.0.071 VIM VIM 7.0.072 VIM VIM 7.0.073 VIM VIM 7.0.074 VIM VIM 7.0.075 VIM VIM 7.0.076 VIM VIM 7.0.077 VIM VIM 7.0.078 VIM VIM 7.0.079 VIM VIM 7.0.080 VIM VIM 7.0.081 VIM VIM 7.0.082 VIM VIM 7.0.083 VIM VIM 7.0.084 VIM VIM 7.0.085 VIM VIM 7.0.086 VIM VIM 7.0.087 VIM VIM 7.0.088 VIM VIM 7.0.089 VIM VIM 7.0.090 VIM VIM 7.0.091 VIM VIM 7.0.092 VIM VIM 7.0.093 VIM VIM 7.0.094 VIM VIM 7.0.095 VIM VIM 7.0.096 VIM VIM 7.0.097 VIM VIM 7.0.098 VIM VIM 7.0.099 VIM VIM 7.0.100 VIM VIM 7.0.101 VIM VIM 7.0.102 VIM VIM 7.0.103 VIM VIM 7.0.104 VIM VIM 7.0.105 VIM VIM 7.0.106 VIM VIM 7.0.107 VIM VIM 7.0.108 VIM VIM 7.0.109 VIM VIM 7.0.110 VIM VIM 7.0.111 VIM VIM 7.0.112 VIM VIM 7.0.113 VIM VIM 7.0.114 VIM VIM 7.0.115 VIM VIM 7.0.116 VIM VIM 7.0.117 VIM VIM 7.0.118 VIM VIM 7.0.119 VIM VIM 7.0.120 VIM VIM 7.0.121 VIM VIM 7.0.122 VIM VIM 7.0.123 VIM VIM 7.0.124 VIM VIM 7.0.125 VIM VIM 7.0.126 VIM VIM 7.0.127 VIM VIM 7.0.128 VIM VIM 7.0.129 VIM VIM 7.0.130 VIM VIM 7.0.131 VIM VIM 7.0.132 VIM VIM 7.0.133 VIM VIM 7.0.134 VIM VIM 7.0.135 VIM VIM 7.0.136 VIM VIM 7.0.137 VIM VIM 7.0.138 VIM VIM 7.0.139 VIM VIM 7.0.140 VIM VIM 7.0.141 VIM VIM 7.0.142 VIM VIM 7.0.143 VIM VIM 7.0.144 VIM VIM 7.0.145 VIM VIM 7.0.146 VIM VIM 7.0.147 VIM VIM 7.0.148 VIM VIM 7.0.149 VIM VIM 7.0.150 VIM VIM 7.0.151 VIM VIM 7.0.152 VIM VIM 7.0.153 VIM VIM 7.0.154 VIM VIM 7.0.155 VIM VIM 7.0.156 VIM VIM 7.0.157 VIM VIM 7.0.158 VIM VIM 7.0.159 VIM VIM 7.0.160 VIM VIM 7.0.161 VIM VIM 7.0.162 VIM VIM 7.0.163 VIM VIM 7.0.164 VIM VIM 7.0.165 VIM VIM 7.0.166 VIM VIM 7.0.167 VIM VIM 7.0.168 VIM VIM 7.0.169 VIM VIM 7.0.170 VIM VIM 7.0.171 VIM VIM 7.0.172 VIM VIM 7.0.173 VIM VIM 7.0.174 VIM VIM 7.0.175 VIM VIM 7.0.176 VIM VIM 7.0.177 VIM VIM 7.0.178 VIM VIM 7.0.179 VIM VIM 7.0.180 VIM VIM 7.0.181 VIM VIM 7.0.182 VIM VIM 7.0.183 VIM VIM 7.0.184 VIM VIM 7.0.185 VIM VIM 7.0.186 VIM VIM 7.0.187 VIM VIM 7.0.188 VIM VIM 7.0.189 VIM VIM 7.0.190 VIM VIM 7.0.191 VIM VIM 7.0.192 VIM VIM 7.0.193 VIM VIM 7.0.194 VIM VIM 7.0.195 VIM VIM 7.0.196 VIM VIM 7.0.197 VIM VIM 7.0.198 VIM VIM 7.0.199 VIM VIM 7.0.200 VIM VIM 7.0.201 VIM VIM 7.0.202 VIM VIM 7.0.203 VIM VIM 7.0.204 VIM VIM 7.0.205 VIM VIM 7.0.206 VIM VIM 7.0.207 VIM VIM 7.0.208 VIM VIM 7.0.209 VIM VIM 7.0.210 VIM VIM 7.0.211 VIM VIM 7.0.212 VIM VIM 7.0.213 VIM VIM 7.0.214 VIM VIM 7.0.215 VIM VIM 7.0.216 VIM VIM 7.0.217 VIM VIM 7.0.218 VIM VIM 7.0.219 VIM VIM 7.0.220 VIM VIM 7.0.221 VIM VIM 7.0.222 VIM VIM 7.0.223 VIM VIM 7.0.224 VIM VIM 7.0.225 VIM VIM 7.0.226 VIM VIM 7.0.227 VIM VIM 7.0.228 VIM VIM 7.0.229 VIM VIM 7.0.230 VIM VIM 7.0.231 VIM VIM 7.0.232 VIM VIM 7.0.233 VIM VIM 7.0.234 VIM VIM 7.0.235 VIM VIM 7.0.236 VIM VIM 7.0.237 VIM VIM 7.0.238 VIM VIM 7.0.239 VIM VIM 7.0.240 VIM VIM 7.0.241 VIM VIM 7.0.242 VIM VIM 7.0.243 VIM VIM 7.0B VIM VIM 7.0B01 VIM VIM 7.0B02 VIM VIM 7.0C VIM VIM 7.0C01 VIM VIM 7.0C02 VIM VIM 7.0C03 VIM VIM 7.0C10 VIM VIM 7.0C11 VIM VIM 7.0C12 VIM VIM 7.0C13 VIM VIM 7.0D VIM VIM 7.0D01 VIM VIM 7.0D02 VIM VIM 7.0D03 VIM VIM 7.0D04 VIM VIM 7.0D05 VIM VIM 7.0E VIM VIM 7.00E\+01 VIM VIM 7.00E\+02 VIM VIM 7.00E\+03 VIM VIM 7.00E\+04 VIM VIM 7.00E\+05 VIM VIM 7.00E\+06 VIM VIM 7.00E\+07 VIM VIM 7.0F VIM VIM 7.0F01 VIM VIM 7.0F02 VIM VIM 7.0F03 VIM VIM 7.0F04 VIM VIM 7.0F05 VIM VIM 7.0G VIM VIM 7.0G01 VIM VIM 7.0G02 VIM VIM 7.0G03 VIM VIM 7.0G04 VIM VIM 7.0G05 VIM VIM 7.01 VIM VIM 7.1.001 VIM VIM 7.1.002 VIM VIM 7.1.003 VIM VIM 7.1.004 VIM VIM 7.1.005 VIM VIM 7.1.006 VIM VIM 7.1.007 VIM VIM 7.1.008 VIM VIM 7.1.009 VIM VIM 7.1.010 VIM VIM 7.1.011 VIM VIM 7.1.012 VIM VIM 7.1.013 VIM VIM 7.1.014 VIM VIM 7.1.015 VIM VIM 7.1.016 VIM VIM 7.1.017 VIM VIM 7.1.018 VIM VIM 7.1.019 VIM VIM 7.1.020 VIM VIM 7.1.021 VIM VIM 7.1.022 VIM VIM 7.1.023 VIM VIM 7.1.024 VIM VIM 7.1.025 VIM VIM 7.1.026 VIM VIM 7.1.027 VIM VIM 7.1.028 VIM VIM 7.1.029 VIM VIM 7.1.030 VIM VIM 7.1.031 VIM VIM 7.1.032 VIM VIM 7.1.033 VIM VIM 7.1.034 VIM VIM 7.1.035 VIM VIM 7.1.036 VIM VIM 7.1.037 VIM VIM 7.1.038 VIM VIM 7.1.039 VIM VIM 7.1.040 VIM VIM 7.1.041 VIM VIM 7.1.042 VIM VIM 7.1.043 VIM VIM 7.1.044 VIM VIM 7.1.045 VIM VIM 7.1.046 VIM VIM 7.1.047 VIM VIM 7.1.048 VIM VIM 7.1.049 VIM VIM 7.1.050 VIM VIM 7.1.051 VIM VIM 7.1.052 VIM VIM 7.1.053 VIM VIM 7.1.054 VIM VIM 7.1.055 VIM VIM 7.1.056 VIM VIM 7.1.057 VIM VIM 7.1.058 VIM VIM 7.1.059 VIM VIM 7.1.060 VIM VIM 7.1.061 VIM VIM 7.1.062 VIM VIM 7.1.063 VIM VIM 7.1.064 VIM VIM 7.1.065 VIM VIM 7.1.066 VIM VIM 7.1.067 VIM VIM 7.1.068 VIM VIM 7.1.069 VIM VIM 7.1.070 VIM VIM 7.1.071 VIM VIM 7.1.072 VIM VIM 7.1.073 VIM VIM 7.1.074 VIM VIM 7.1.075 VIM VIM 7.1.076 VIM VIM 7.1.077 VIM VIM 7.1.078 VIM VIM 7.1.079 VIM VIM 7.1.080 VIM VIM 7.1.081 VIM VIM 7.1.082 VIM VIM 7.1.084 VIM VIM 7.1.085 VIM VIM 7.1.086 VIM VIM 7.1.087 VIM VIM 7.1.088 VIM VIM 7.1.089 VIM VIM 7.1.090 VIM VIM 7.1.091 VIM VIM 7.1.092 VIM VIM 7.1.093 VIM VIM 7.1.094 VIM VIM 7.1.095 VIM VIM 7.1.096 VIM VIM 7.1.097 VIM VIM 7.1.098 VIM VIM 7.1.099 VIM VIM 7.1.100 VIM VIM 7.1.101 VIM VIM 7.1.102 VIM VIM 7.1.103 VIM VIM 7.1.104 VIM VIM 7.1.105 VIM VIM 7.1.106 VIM VIM 7.1.107 VIM VIM 7.1.108 VIM VIM 7.1.109 VIM VIM 7.1.110 VIM VIM 7.1.111 VIM VIM 7.1.112 VIM VIM 7.1.113 VIM VIM 7.1.114 VIM VIM 7.1.115 VIM VIM 7.1.116 VIM VIM 7.1.117 VIM VIM 7.1.118 VIM VIM 7.1.119 VIM VIM 7.1.120 VIM VIM 7.1.121 VIM VIM 7.1.122 VIM VIM 7.1.123 VIM VIM 7.1.124 VIM VIM 7.1.125 VIM VIM 7.1.126 VIM VIM 7.1.127 VIM VIM 7.1.128 VIM VIM 7.1.129 VIM VIM 7.1.130 VIM VIM 7.1.131 VIM VIM 7.1.132 VIM VIM 7.1.133 VIM VIM 7.1.134 VIM VIM 7.1.135 VIM VIM 7.1.136 VIM VIM 7.1.137 VIM VIM 7.1.138 VIM VIM 7.1.139 VIM VIM 7.1.140 VIM VIM 7.1.141 VIM VIM 7.1.142 VIM VIM 7.1.143 VIM VIM 7.1.144 VIM VIM 7.1.145 VIM VIM 7.1.146 VIM VIM 7.1.147 VIM VIM 7.1.148 VIM VIM 7.1.149 VIM VIM 7.1.150 VIM VIM 7.1.151 VIM VIM 7.1.152 VIM VIM 7.1.153 VIM VIM 7.1.154 VIM VIM 7.1.155 VIM VIM 7.1.156 VIM VIM 7.1.157 VIM VIM 7.1.158 VIM VIM 7.1.159 VIM VIM 7.1.160 VIM VIM 7.1.161 VIM VIM 7.1.162 VIM VIM 7.1.163 VIM VIM 7.1.164 VIM VIM 7.1.165 VIM VIM 7.1.166 VIM VIM 7.1.167 VIM VIM 7.1.168 VIM VIM 7.1.169 VIM VIM 7.1.170 VIM VIM 7.1.171 VIM VIM 7.1.172 VIM VIM 7.1.173 VIM VIM 7.1.174 VIM VIM 7.1.175 VIM VIM 7.1.176 VIM VIM 7.1.177 VIM VIM 7.1.178 VIM VIM 7.1.179 VIM VIM 7.1.180 VIM VIM 7.1.181 VIM VIM 7.1.182 VIM VIM 7.1.183 VIM VIM 7.1.184 VIM VIM 7.1.185 VIM VIM 7.1.186 VIM VIM 7.1.187 VIM VIM 7.1.188 VIM VIM 7.1.189 VIM VIM 7.1.190 VIM VIM 7.1.191 VIM VIM 7.1.192 VIM VIM 7.1.193 VIM VIM 7.1.194 VIM VIM 7.1.195 VIM VIM 7.1.196 VIM VIM 7.1.197 VIM VIM 7.1.198 VIM VIM 7.1.199 VIM VIM 7.1.200 VIM VIM 7.1.201 VIM VIM 7.1.202 VIM VIM 7.1.203 VIM VIM 7.1.204 VIM VIM 7.1.205 VIM VIM 7.1.206 VIM VIM 7.1.207 VIM VIM 7.1.208 VIM VIM 7.1.209 VIM VIM 7.1.210 VIM VIM 7.1.211 VIM VIM 7.1.212 VIM VIM 7.1.213 VIM VIM 7.1.214 VIM VIM 7.1.215 VIM VIM 7.1.216 VIM VIM 7.1.217 VIM VIM 7.1.218 VIM VIM 7.1.219 VIM VIM 7.1.220 VIM VIM 7.1.221 VIM VIM 7.1.222 VIM VIM 7.1.223 VIM VIM 7.1.224 VIM VIM 7.1.225 VIM VIM 7.1.226 VIM VIM 7.1.227 VIM VIM 7.1.228 VIM VIM 7.1.229 VIM VIM 7.1.230 VIM VIM 7.1.231 VIM VIM 7.1.232 VIM VIM 7.1.233 VIM VIM 7.1.234 VIM VIM 7.1.235 VIM VIM 7.1.236 VIM VIM 7.1.237 VIM VIM 7.1.238 VIM VIM 7.1.239 VIM VIM 7.1.240 VIM VIM 7.1.241 VIM VIM 7.1.242 VIM VIM 7.1.243 VIM VIM 7.1.244 VIM VIM 7.1.245 VIM VIM 7.1.246 VIM VIM 7.1.247 VIM VIM 7.1.248 VIM VIM 7.1.249 VIM VIM 7.1.250 VIM VIM 7.1.251 VIM VIM 7.1.252 VIM VIM 7.1.253 VIM VIM 7.1.254 VIM VIM 7.1.255 VIM VIM 7.1.256 VIM VIM 7.1.257 VIM VIM 7.1.258 VIM VIM 7.1.259 VIM VIM 7.1.260 VIM VIM 7.1.261 VIM VIM 7.1.262 VIM VIM 7.1.263 VIM VIM 7.1.264 VIM VIM 7.1.265 VIM VIM 7.1.266 VIM VIM 7.1.267 VIM VIM 7.1.268 VIM VIM 7.1.269 VIM VIM 7.1.270 VIM VIM 7.1.271 VIM VIM 7.1.272 VIM VIM 7.1.273 VIM VIM 7.1.274 VIM VIM 7.1.275 VIM VIM 7.1.276 VIM VIM 7.1.277 VIM VIM 7.1.278 VIM VIM 7.1.279 VIM VIM 7.1.280 VIM VIM 7.1.281 VIM VIM 7.1.282 VIM VIM 7.1.283 VIM VIM 7.1.284 VIM VIM 7.1.285 VIM VIM 7.1.286 VIM VIM 7.1.287 VIM VIM 7.1.288 VIM VIM 7.1.289 VIM VIM 7.1.290 VIM VIM 7.1.291 VIM VIM 7.1.292 VIM VIM 7.1.293 VIM VIM 7.1.294 VIM VIM 7.1.295 VIM VIM 7.1.296 VIM VIM 7.1.297 VIM VIM 7.1.298 VIM VIM 7.1.299 VIM VIM 7.1.300 VIM VIM 7.1.301 VIM VIM 7.1.302 VIM VIM 7.1.303 VIM VIM 7.1.304 VIM VIM 7.1.305 VIM VIM 7.1.306 VIM VIM 7.1.307 VIM VIM 7.1.308 VIM VIM 7.1.309 VIM VIM 7.1.310 VIM VIM 7.1.311 VIM VIM 7.1.312 VIM VIM 7.1.313 VIM VIM 7.1.314 VIM VIM 7.1.315 VIM VIM 7.1.316 VIM VIM 7.1.317 VIM VIM 7.1.318 VIM VIM 7.1.319 VIM VIM 7.1.320 VIM VIM 7.1.321 VIM VIM 7.1.322 VIM VIM 7.1.323 VIM VIM 7.1.324 VIM VIM 7.1.325 VIM VIM 7.1.326 VIM VIM 7.1.327 VIM VIM 7.1.328 VIM VIM 7.1.329 VIM VIM 7.1.330 VIM VIM 7.1A VIM VIM 7.1A.001 VIM VIM 7.1B VIM VIM 7.1B.001 VIM VIM 7.1B.002 VIM VIM 7.02 VIM VIM 7.2	638

Nessus

NASL family	Mandriva Local Security Checks
NASL id	MANDRIVA_MDVSA-2009-047.NASL
description	Python has a variable called sys.path that contains all paths where Python loads modules by using import scripting procedure. A wrong handling of that variable enables local attackers to execute arbitrary code via Python scripting in the current Vim working directory (CVE-2009-0316). This update provides fix for that vulnerability. Update : This update also provides updated packages for Mandriva Linux 2008.0.
last seen	2020-06-01
modified	2020-06-02
plugin id	36407
published	2009-04-23
reporter	This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/36407
title	Mandriva Linux Security Advisory : vim (MDVSA-2009:047-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_0_GVIM-090225.NASL
description	The VI Improved editor (vim) was updated to version 7.2.108 to fix various security problems and other bugs. CVE-2008-4677: The netrw plugin sent credentials to all servers. CVE-2009-0316: The python support used a search path including the current directory, allowing code injection when python code was used. CVE-2008-2712: Arbitrary code execution in vim helper plugins filetype.vim, zipplugin, xpm.vim, gzip_vim, and netrw were fixed. CVE-2008-3074: tarplugin code injection CVE-2008-3075: zipplugin code injection CVE-2008-3076: several netrw bugs, code injection CVE-2008-6235: code injection in the netrw plugin CVE-2008-4677: credential disclosure by netrw plugin
last seen	2020-06-01
modified	2020-06-02
plugin id	39980
published	2009-07-21
reporter	This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/39980
title	openSUSE Security Update : gvim (gvim-561)

NASL family	SuSE Local Security Checks
NASL id	SUSE_GVIM-6023.NASL
description	The VI Improved editor (vim) was updated to version 7.2.108 to fix various security problems and other bugs. CVE-2008-4677: The netrw plugin sent credentials to all servers. CVE-2009-0316: The python support used a search path including the current directory, allowing code injection when python code was used. CVE-2008-2712: Arbitrary code execution in vim helper plugins filetype.vim, zipplugin, xpm.vim, gzip_vim, and netrw were fixed. CVE-2008-3074: tarplugin code injection CVE-2008-3075: zipplugin code injection CVE-2008-3076: several netrw bugs, code injection CVE-2008-6235: code injection in the netrw plugin CVE-2008-4677: credential disclosure by netrw plugin
last seen	2020-06-01
modified	2020-06-02
plugin id	35921
published	2009-03-13
reporter	This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/35921
title	openSUSE 10 Security Update : gvim (gvim-6023)

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_SECUPD2010-002.NASL
description	The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-002 applied. This security update contains fixes for the following products : - AppKit - Application Firewall - AFP Server - Apache - ClamAV - CoreTypes - CUPS - curl - Cyrus IMAP - Cyrus SASL - Disk Images - Directory Services - Event Monitor - FreeRADIUS - FTP Server - iChat Server - Image RAW - Libsystem - Mail - Mailman - OS Services - Password Server - perl - PHP - PS Normalizer - Ruby - Server Admin - SMB - Tomcat - unzip - vim - Wiki Server - X11 - xar
last seen	2020-06-01
modified	2020-06-02
plugin id	45373
published	2010-03-29
reporter	This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/45373
title	Mac OS X Multiple Vulnerabilities (Security Update 2010-002)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2011-0027.NASL
description	Updated python packages that fix multiple security issues, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Python is an interpreted, interactive, object-oriented programming language. It was found that many applications embedding the Python interpreter did not specify a valid full path to the script or application when calling the PySys_SetArgv API function, which could result in the addition of the current working directory to the module search path (sys.path). A local attacker able to trick a victim into running such an application in an attacker-controlled directory could use this flaw to execute code with the victim
last seen	2020-06-01
modified	2020-06-02
plugin id	51524
published	2011-01-14
reporter	This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/51524
title	RHEL 5 : python (RHSA-2011:0027)

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_1_GVIM-090225.NASL
description	The VI Improved editor (vim) was updated to version 7.2.108 to fix various security problems and other bugs. CVE-2008-4677: The netrw plugin sent credentials to all servers. CVE-2009-0316: The python support used a search path including the current directory, allowing code injection when python code was used. CVE-2008-2712: Arbitrary code execution in vim helper plugins filetype.vim, zipplugin, xpm.vim, gzip_vim, and netrw were fixed. CVE-2008-3074: tarplugin code injection CVE-2008-3075: zipplugin code injection CVE-2008-3076: several netrw bugs, code injection CVE-2008-6235: code injection in the netrw plugin CVE-2008-4677: credential disclosure by netrw plugin
last seen	2020-06-01
modified	2020-06-02
plugin id	40230
published	2009-07-21
reporter	This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/40230
title	openSUSE Security Update : gvim (gvim-561)

Seebug

bulletinFamily	exploit
description	BUGTRAQ ID: 33447 CVE(CAN) ID: CVE-2009-0316 VIM是一款免费开放源代码文本编辑器，可使用在Unix/Linux操作系统下。 VIM的python接口使用argv[0]调用PySys_SetArgv函数。由于Python对sys.path变量附加了空字符串，如果工作目录中的文件名匹配VIM试图导入的python模块名，就可能允许本地用户在系统中执行任意代码。 VIM Development Group VIM < 7.2.045 厂商补丁： VIM Development Group --------------------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： <a href=https://svn.pardus.org.tr/pardus/2008/applications/editors/vim/files/official/7.2.045 target=_blank rel=external nofollow>https://svn.pardus.org.tr/pardus/2008/applications/editors/vim/files/official/7.2.045</a>
id	SSV:4819
last seen	2017-11-19
modified	2009-02-23
published	2009-02-23
reporter	Root
title	Vim PySys_SetArgv函数本地命令执行漏洞

References

CVE is a registered MITRE Corporation trademark and MITRE's CVE website is the authoritative source of CVE content. CWE is a registered MITRE Corporation trademark and MITRE's CWE website is the authoritative source of CWE content.