CVE-2005-2368: vim_development_group vim OS Command Injection
Vulnerability summary
CVE-2005-2368 is a high (CVSS 9.3) OS Command Injection vulnerability in vim_development_group vim. EPSS estimates a 2.73% chance of exploitation in the next 30 days, higher than 85.8% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 26-07-2005PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
vim 6.3 before 6.3.082, with modelines enabled, allows external user-assisted attackers to execute arbitrary commands via shell metacharacters in the (1) glob or (2) expand commands of a foldexpr expression for calculating fold levels.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
2.73%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
0.00 pp
From 2.73% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (lists.grok.org.uk)
Maturity: unknown
Exploit Reference (guninski.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat6 products
- vim< 1:6.3.046-0.30E.4 | < 1:6.3.046-0.40E.7
- vim-common< 1:6.3.046-0.30E.4 | < 1:6.3.046-0.40E.7
- vim-debuginfo< 1:6.3.046-0.30E.4 | < 1:6.3.046-0.40E.7
- vim-enhanced< 1:6.3.046-0.30E.4 | < 1:6.3.046-0.40E.7
- vim-minimal< 1:6.3.046-0.30E.4 | < 1:6.3.046-0.40E.7
Debian1 product
- vim< 1:6.3-085+1 | < 1:6.3-085+0.0etch1
Vim_development_group1 product
- vim6.3 | 6.3.011 | 6.3.025 | 6.3.030 | 6.3.044 | 6.3.081
3 vendors · 8 products
References
15 links- lists.grok.org.uk/pipermail/full-disclosure/2005-July/035402.htmlMailing ListX Refsource FULLDISCExploitPatchVendor Advisory
- www.guninski.com/where_do_you_want_billg_to_go_today_5.htmlX Refsource MISCExploitPatchVendor Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11302VDB EntrySignatureX Refsource OVAL
