CVE-2019-12735
Description
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.
Risk Information
Base Score
8.6
MODERATE
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS Score
Exploitation Probability
66.838
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Vulnerabilities CVE-2019-12735 are affected in Vim 8.1.1364 | Windows |
| Vi IMproved - enhanced vi editor (USN-4016-1) vim_7.4.1689-3ubuntu1.3_i386.deb | Linux |
| Vi IMproved - enhanced vi editor (USN-4016-1) vim_7.4.1689-3ubuntu1.3_amd64.deb | Linux |
| Vi IMproved - enhanced vi editor (USN-4016-1) vim_8.0.1453-1ubuntu1.1_i386.deb | Linux |
| Vi IMproved - enhanced vi editor (USN-4016-1) vim_8.0.1453-1ubuntu1.1_amd64.deb | Linux |
| Vi IMproved - enhanced vi editor (USN-4016-1) vim_8.0.1766-1ubuntu1.1_i386.deb | Linux |
| Vi IMproved - enhanced vi editor (USN-4016-1) vim_8.0.1766-1ubuntu1.1_amd64.deb | Linux |
| Vi IMproved - enhanced vi editor (USN-4016-1) vim_8.1.0320-1ubuntu3.1_i386.deb | Linux |
| Vi IMproved - enhanced vi editor (USN-4016-1) vim_8.1.0320-1ubuntu3.1_amd64.deb | Linux |
| Vi IMproved - enhanced vi editor (USN-4016-1) vim-gui-common_7.4.1689-3ubuntu1.3_all.deb | Linux |
| Vi IMproved - enhanced vi editor (USN-4016-1) vim-gui-common_8.0.1453-1ubuntu1.1_all.deb | Linux |
| Vi IMproved - enhanced vi editor (USN-4016-1) vim-gui-common_8.0.1766-1ubuntu1.1_all.deb | Linux |
| Vi IMproved - enhanced vi editor (USN-4016-1) vim-gui-common_8.1.0320-1ubuntu3.1_all.deb | Linux |
| heavily refactored vim fork (USN-4016-2) neovim_0.3.1-1ubuntu0.1_i386.deb | Linux |
| heavily refactored vim fork (USN-4016-2) neovim_0.3.1-1ubuntu0.1_amd64.deb | Linux |
| heavily refactored vim fork (USN-4016-2) neovim_0.3.4-1ubuntu0.19.04.1_i386.deb | Linux |
| heavily refactored vim fork (USN-4016-2) neovim_0.3.4-1ubuntu0.19.04.1_amd64.deb | Linux |
| heavily refactored vim fork (USN-4016-2) neovim-runtime_0.3.1-1ubuntu0.1_all.deb | Linux |
| heavily refactored vim fork (USN-4016-2) neovim-runtime_0.3.4-1ubuntu0.19.04.1_all.deb | Linux |
| vim security update(DSA-4467-1) vim_8.0.0197-4+deb9u2_i386.deb | Linux |
| vim security update(DSA-4467-1) vim_8.0.0197-4+deb9u2_amd64.deb | Linux |
| SUSE-SU-2019:1456-1(SUSE Linux Enterprise Desktop 12-SP4 ) gvim-7.4.326-17.3.1.x86_64.rpm | Linux |
| SUSE-SU-2019:1456-1(SUSE Linux Enterprise Desktop 12-SP3 ) gvim-debuginfo-7.4.326-17.3.1.x86_64.rpm | Linux |
| SUSE-SU-2019:1456-1(SUSE Linux Enterprise Desktop 12-SP3 ) vim-data-7.4.326-17.3.1.noarch.rpm | Linux |
| SUSE-SU-2019:1456-1(SUSE Linux Enterprise Desktop 12-SP3 ) vim-debugsource-7.4.326-17.3.1.x86_64.rpm | Linux |
| neovim security update(DSA-4487-1) neovim_0.1.7-4+deb9u1_i386.deb | Linux |
| neovim security update(DSA-4487-1) neovim_0.1.7-4+deb9u1_amd64.deb | Linux |
| (RHSA-2019:1619) vim security update vim-X11-8.0.1763-11.el8_0.x86_64.rpm | Linux |
| (RHSA-2019:1619) vim security update vim-common-8.0.1763-11.el8_0.x86_64.rpm | Linux |
| (RHSA-2019:1619) vim security update vim-debugsource-8.0.1763-11.el8_0.x86_64.rpm | Linux |
| (RHSA-2019:1619) vim security update vim-enhanced-8.0.1763-11.el8_0.x86_64.rpm | Linux |
| (RHSA-2019:1619) vim security update vim-filesystem-8.0.1763-11.el8_0.noarch.rpm | Linux |
| (RHSA-2019:1619) vim security update vim-minimal-8.0.1763-11.el8_0.x86_64.rpm | Linux |
| Vim-common update (ELSA-2019-1619) vim-common-8.0.1763-11.el8_0.x86_64.rpm | Linux |
| Vim-enhanced update (ELSA-2019-1619) vim-enhanced-8.0.1763-11.el8_0.x86_64.rpm | Linux |
| Vim-minimal update (ELSA-2019-1619) vim-minimal-8.0.1763-11.el8_0.x86_64.rpm | Linux |
| Vim-X11 update (ELSA-2019-1619) vim-X11-8.0.1763-11.el8_0.x86_64.rpm | Linux |
| Vim-filesystem update (ELSA-2019-1619) vim-filesystem-8.0.1763-11.el8_0.noarch.rpm | Linux |
| Vim-common update (ELSA-2019-1619) vim-common-7.4.160-6.el7_6.x86_64.rpm | Linux |
| Vim-enhanced update (ELSA-2019-1619) vim-enhanced-7.4.160-6.el7_6.x86_64.rpm | Linux |
| Vim-filesystem update (ELSA-2019-1619) vim-filesystem-7.4.160-6.el7_6.x86_64.rpm | Linux |
| Vim-minimal update (ELSA-2019-1619) vim-minimal-7.4.160-6.el7_6.x86_64.rpm | Linux |
| Vim-X11 update (ELSA-2019-1619) vim-X11-7.4.160-6.el7_6.x86_64.rpm | Linux |
| (RHSA-2019:1619)Important: security update vim-X11-debuginfo-8.0.1763-11.el8_0.x86_64.rpm | Linux |
| (RHSA-2019:1619)Important: security update vim-common-debuginfo-8.0.1763-11.el8_0.x86_64.rpm | Linux |
| (RHSA-2019:1619)Important: security update vim-debuginfo-7.4.160-6.el7_6.x86_64.rpm | Linux |
| (RHSA-2019:1619)Important: security update vim-debuginfo-8.0.1763-11.el8_0.x86_64.rpm | Linux |
| (RHSA-2019:1619)Important: security update vim-enhanced-debuginfo-8.0.1763-11.el8_0.x86_64.rpm | Linux |
| (RHSA-2019:1619)Important: security update vim-minimal-debuginfo-8.0.1763-11.el8_0.x86_64.rpm | Linux |
| Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) Vulnerability (CVE-2019-12735) | NCM |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234