CVE-2002-1377 - CVE House
Back to Database
Status published Medium CVE-2002-1377

vim 6.0 and 6.1, and possibly other versions, allows attackers...

Vulnerability Description

vim 6.0 and 6.1, and possibly other versions, allows attackers to execute arbitrary commands using the libcall feature in modelines, which are not sandboxed but may be executed when vim is used to edit a malicious file, as demonstrated using mutt.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2002-1377

Credits & Attribution

No credits recorded in the NVD database.

References

More from vim development group

View All →
CVE-2007-2953
Format string vulnerability in the helptags_one function in src/ex_cmds.c in...
Medium 6.8
CVE-2007-2438
The sandbox for vim allows dangerous functions such as (1)...
High 7.6
CVE-2005-2368
vim 6.3 before 6.3.082, with modelines enabled, allows external user-assisted...
Critical 9.3
CVE-2005-0069
The (1) tcltags or (2) vimspell.sh scripts in vim 6.3...
Medium 4.6
CVE-2004-1138
VIM before 6.3 and gVim before 6.3 allow local users...
High 7.2

Affected Vendor

vim development group

View all reports →

Affected Software

vim
Vulnerable Versions:
5.0, 5.1, 5.2, 5.3, 5.4, 5.5, 5.6, 5.7, 5.8, 6.0, 6.1

Timeline

Official Publish: September 1st, 2004
Last Modified: August 8th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.