CVE-2008-3076

Name	CVE-2008-3076
Description	The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1733-1
Debian Bugs	506919

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
vim (PTS)	jessie, jessie (lts)	2:7.4.488-7+deb8u11	fixed
	stretch (security)	2:8.0.0197-4+deb9u7	fixed
	stretch (lts), stretch	2:8.0.0197-4+deb9u11	fixed
	buster (security), buster, buster (lts)	2:8.1.0875-5+deb10u6	fixed
	bullseye	2:8.2.2434-3+deb11u1	fixed
	bookworm	2:9.0.1378-2	fixed
	sid, trixie	2:9.1.0861-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
vim	source	etch	1:7.0-122+1etch5		DSA-1733-1
vim	source	lenny	1:7.1.314-3+lenny1			506919
vim	source	squeeze	1:7.1.314-3+lenny1			506919
vim	source	(unstable)	2:7.2.010-1			506919