CVE-2004-1138

NameCVE-2004-1138
DescriptionVIM before 6.3 and gVim before 6.3 allow local users to execute arbitrary commands via a file containing a crafted modeline that is executed when the file is viewed using options such as (1) termcap, (2) printdevice, (3) titleold, (4) filetype, (5) syntax, (6) backupext, (7) keymap, (8) patchmode, or (9) langmenu.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
vim (PTS)jessie, jessie (lts)2:7.4.488-7+deb8u11fixed
stretch (security)2:8.0.0197-4+deb9u7fixed
stretch (lts), stretch2:8.0.0197-4+deb9u11fixed
buster (security), buster, buster (lts)2:8.1.0875-5+deb10u6fixed
bullseye2:8.2.2434-3+deb11u1fixed
bookworm2:9.0.1378-2fixed
sid, trixie2:9.1.0777-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
vimsource(unstable)1:6.3-046+0sarge1

Search for package or bug name: Reporting problems