CVE-2002-1377

vim 6.0 and 6.1, and possibly other versions, allows attackers to execute arbitrary commands using the libcall feature in modelines, which are not sandboxed but may be executed when vim is used to edit a malicious file, as demonstrated using mutt.

Affected Software

Name	Vendor	Start Version	End Version
Vim	Vim_development_group	5.0 (including)	5.0 (including)
Vim	Vim_development_group	5.1 (including)	5.1 (including)
Vim	Vim_development_group	5.2 (including)	5.2 (including)
Vim	Vim_development_group	5.3 (including)	5.3 (including)
Vim	Vim_development_group	5.4 (including)	5.4 (including)
Vim	Vim_development_group	5.5 (including)	5.5 (including)
Vim	Vim_development_group	5.6 (including)	5.6 (including)
Vim	Vim_development_group	5.7 (including)	5.7 (including)
Vim	Vim_development_group	5.8 (including)	5.8 (including)
Vim	Vim_development_group	6.0 (including)	6.0 (including)
Vim	Vim_development_group	6.1 (including)	6.1 (including)
Red Hat Enterprise Linux AS (Advanced Server) version 2.1	RedHat		*
Red Hat Linux 6.2	RedHat		*
Red Hat Linux 7.0	RedHat		*
Red Hat Linux 7.1	RedHat		*
Red Hat Linux 7.2	RedHat		*
Red Hat Linux 7.3	RedHat		*
Red Hat Linux 8.0	RedHat		*
Red Hat Linux Advanced Workstation 2.1	RedHat		*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2002-1377
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html

Affected Software

References