CVE-2016-1248: debian debian_linux Improper Input Validation
CVSS: 7.8v3.0HighModified
AliasesALPINE-CVE-2016-1248SUSE-SU-2016:2938-1SUSE-SU-2016:2942-1RHSA-2016:2972UBUNTU-CVE-2016-1248USN-3139-1DEBIAN-CVE-2016-1248DLA-718-1DSA-3722-1
Published 23-11-2016Last modified 05-08-2024
Vulnerability summary
CVE-2016-1248 is a high (CVSS 7.8) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 25.31% chance of exploitation in the next 30 days, higher than 97.9% of scored vulnerabilities.
CVSS score
7.8/10
010
High · v3.0 (NVD)EPSS score
25.31%
0%100%
High · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 23-11-2016PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 7.8Preferred score · NVD (NIST)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSources5 sources · 7.5–7.8
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
25.31%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 25.31% on 18-09-2026
18-09-202618-10-2026
EPSS score25.31%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse9 products
- vim&distro=SUSE Linux Enterprise Desktop 12 SP1< 7.4.326-7.1
- vim&distro=SUSE Linux Enterprise Desktop 12 SP2< 7.4.326-7.1
- vim&distro=SUSE Linux Enterprise Server 11 SP4< 7.2-8.17.1
- vim&distro=SUSE Linux Enterprise Server 12 SP1< 7.4.326-7.1
- vim&distro=SUSE Linux Enterprise Server 12 SP2< 7.4.326-7.1
Redhat7 products
- vim< 2:7.4.629-5.el6_8.1 | < 2:7.4.160-1.el7_3.1
- vim-common< 2:7.4.629-5.el6_8.1 | < 2:7.4.160-1.el7_3.1
- vim-debuginfo< 2:7.4.629-5.el6_8.1 | < 2:7.4.160-1.el7_3.1
- vim-enhanced< 2:7.4.629-5.el6_8.1 | < 2:7.4.160-1.el7_3.1
- vim-filesystem< 2:7.4.629-5.el6_8.1 | < 2:7.4.160-1.el7_3.1
Debian3 products
- neovim< 0.1.6-4
- vim< 2:8.0.0095-1 | < 2:7.4.488-7+deb8u1 | < 2:7.3.547-7+deb7u1
- debian_linuxEOL8.0
Alpine1 product
- vim< 8.0.0056-r0 | < 7.4.712-r1 | < 7.4.943-r4 | < 7.4.1831-r2
Ubuntu1 product
- vim< 2:7.4.052-1ubuntu3.1 | < 2:7.4.1689-3ubuntu1.2
Vim1 product
- vim≤ 8.0.0055
6 vendors · 22 products
References
29 links
lists.debian.org/debian-security-announce/2016/msg00305.htmlX Refsource CONFIRMThird Party AdvisoryREPORT- github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39aX Refsource CONFIRMPatchVendor Advisory
- lists.debian.org/debian-lts-announce/2016/11/msg00025.htmlMailing ListX Refsource MLISTThird Party AdvisoryREPORT
- github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba72795040X Refsource CONFIRMPatchVendor Advisory
Show all 29 references
- anonscm.debian.org/cgit/pkg-vim/vim.git/tree/debian/changelogX Refsource CONFIRMPatchThird Party AdvisoryREPORT
- bugzilla.suse.com/988903REPORT
