CVE-2008-2712: canonical ubuntu_linux Improper Input Validation

CVSS: 9.3v2.0HighModified

AliasesDEBIAN-CVE-2008-2712DTSA-143-1

Published 16-06-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-2712 is a high (CVSS 9.3) Improper Input Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 15.04% chance of exploitation in the next 30 days, higher than 96.7% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

15.04%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1exploit-database

Advisory lineage

Upstream 0 · Downstream 4

DSA-1733-1 RHSA-2008:0580 RHSA-2008:0617 RHSA-2008:0618

Timeline

16-06-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions, as demonstrated using (1) filetype.vim, (3) xpm.vim, (4) gzip_vim, and (5) netrw. NOTE: the originally reported version was 7.1.314, but the researcher actually found this set of issues in 7.1.298. NOTE: the zipplugin issue (originally vector 2 in this identifier) has been subsumed by CVE-2008-3075.

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

15.04%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

0.00 pp

From 15.04% on 19-09-2026

19-09-202619-10-2026

EPSS score

15.04%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

exploit-databaselocallinuxUnverified
Vim 7.x - Vim Script Multiple Command Execution Vulnerabilities
Maturity: poc

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Canonical1 product

ubuntu_linuxEOL6.06 | 7.10 | 8.04 | 8.10

Debian1 product

vim< 1:7.1.314-3 | < 1:7.1.293-3+lenny1

Vim1 product

vim≤ 6.4 | ≥ 7.0, ≤ 7.1.314

3 vendors · 3 products

References

41 links

www.vmware.com/security/advisories/VMSA-2009-0004.htmlX Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
www.redhat.com/support/errata/RHSA-2008-0618.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.rdancer.org/vulnerablevim.htmlX Refsource MISCBroken Link
www.ubuntu.com/usn/USN-712-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6238VDB EntrySignatureX Refsource OVALThird Party Advisory
www.securityfocus.com/bid/31681VDB EntryX Refsource BIDThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/43083VDB EntryX Refsource XFThird Party Advisory
secunia.com/advisories/32858Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/33410Third Party AdvisoryX Refsource SECUNIA

Show all 41 references

lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
www.redhat.com/support/errata/RHSA-2008-0580.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
support.avaya.com/elmodocs2/security/ASA-2009-001.htmX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/34418Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2009/0904VDB EntryX Refsource VUPENThird Party Advisory
www.vupen.com/english/advisories/2009/0033VDB EntryX Refsource VUPENThird Party Advisory
www.securityfocus.com/archive/1/495319/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
www.securityfocus.com/archive/1/493353/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11109VDB EntrySignatureX Refsource OVALThird Party Advisory
www.securityfocus.com/archive/1/502322/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
www.openwall.com/lists/oss-security/2008/06/16/2Mailing ListX Refsource MLISTThird Party Advisory
marc.info?l=bugtraq&m=121494431426308&w=2Mailing ListX Refsource BUGTRAQThird Party Advisory
www.vupen.com/english/advisories/2008/1851/referencesVDB EntryX Refsource VUPENThird Party Advisory
support.avaya.com/elmodocs2/security/ASA-2008-457.htmX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/30731Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/32222Third Party AdvisoryX Refsource SECUNIA
support.apple.com/kb/HT4077X Refsource CONFIRMThird Party Advisory
issues.rpath.com/browse/RPL-2622X Refsource CONFIRMBroken Link
securityreason.com/securityalert/3951Third Party AdvisoryX Refsource SREASON
www.mandriva.com/security/advisories?name=MDVSA-2008:236Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
www.vupen.com/english/advisories/2008/2780VDB EntryX Refsource VUPENThird Party Advisory
www.openwall.com/lists/oss-security/2008/10/15/1Mailing ListX Refsource MLISTThird Party Advisory
secunia.com/advisories/32864Third Party AdvisoryX Refsource SECUNIA
www.securitytracker.com/id?1020293VDB EntryX Refsource SECTRACKThird Party Advisory
lists.apple.com/archives/security-announce/2008/Oct/msg00001.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
support.apple.com/kb/HT3216X Refsource CONFIRMThird Party Advisory
www.securityfocus.com/bid/29715VDB EntryX Refsource BIDThird Party Advisory
wiki.rpath.com/Advisories:rPSA-2008-0247X Refsource CONFIRMThird Party Advisory
www.redhat.com/support/errata/RHSA-2008-0617.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.securityfocus.com/archive/1/493352/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
security-tracker.debian.org/tracker/CVE-2008-2712Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities