CVE-2017-17087

Name	CVE-2017-17087
Description	fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the group ownership of the original file), which allows local users to obtain sensitive information by leveraging an applicable group membership, as demonstrated by /etc/shadow owned by root:shadow mode 0640, but /etc/.shadow.swp owned by root:users mode 0640, a different vulnerability than CVE-2017-1000382.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1871-1, DLA-2876-1, ELA-150-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
vim (PTS)	jessie, jessie (lts)	2:7.4.488-7+deb8u11	fixed
	stretch (security)	2:8.0.0197-4+deb9u7	fixed
	stretch (lts), stretch	2:8.0.0197-4+deb9u11	fixed
	buster (security), buster, buster (lts)	2:8.1.0875-5+deb10u6	fixed
	bullseye	2:8.2.2434-3+deb11u1	fixed
	bookworm	2:9.0.1378-2	fixed
	sid, trixie	2:9.1.0861-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
vim	source	wheezy	7.3.547-7+deb7u5	ELA-150-1
vim	source	jessie	2:7.4.488-7+deb8u4	DLA-1871-1
vim	source	stretch	2:8.0.0197-4+deb9u4	DLA-2876-1
vim	source	(unstable)	2:8.0.1401-1

[wheezy] - vim <no-dsa> (Minor issue)
https://github.com/vim/vim/commit/5a73e0ca54c77e067c3b12ea6f35e3e8681e8cf8 (8.0.1263)