CVE-2004-1138 - CVE House
Back to Database
Status published High CVE-2004-1138

VIM before 6.3 and gVim before 6.3 allow local users...

Vulnerability Description

VIM before 6.3 and gVim before 6.3 allow local users to execute arbitrary commands via a file containing a crafted modeline that is executed when the file is viewed using options such as (1) termcap, (2) printdevice, (3) titleold, (4) filetype, (5) syntax, (6) backupext, (7) keymap, (8) patchmode, or (9) langmenu.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2004-1138

Credits & Attribution

No credits recorded in the NVD database.

References

More from vim development group

View All →
CVE-2007-2953
Format string vulnerability in the helptags_one function in src/ex_cmds.c in...
Medium 6.8
CVE-2007-2438
The sandbox for vim allows dangerous functions such as (1)...
High 7.6
CVE-2005-2368
vim 6.3 before 6.3.082, with modelines enabled, allows external user-assisted...
Critical 9.3
CVE-2005-0069
The (1) tcltags or (2) vimspell.sh scripts in vim 6.3...
Medium 4.6
CVE-2002-1377
vim 6.0 and 6.1, and possibly other versions, allows attackers...
Medium 4.6

Affected Vendor

vim development group

View all reports →

Affected Software

vim
Vulnerable Versions:
5.0, 5.1, 5.2, 5.3, 5.4, 5.5, 5.6, 5.7, 5.8, 6.0, 6.1, 6.2, 6.3.011, 6.3.025, 6.3.030, 6.3.044

Timeline

Official Publish: December 22nd, 2004
Last Modified: August 8th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.