The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4453 advisory.

    Vim (Vi IMproved) is an updated and improved version of the vi editor.

    Security Fix(es):

    * vim: users can execute arbitrary OS commands via scripting interfaces in the rvim restricted mode     (CVE-2019-20807)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在 8.1.0881 之前的 Vim 中，使用者可透過指令碼介面 (例如 Python、Ruby 或 Lua) 規避 rvim 受限模式並執行任意 OS 命令。(CVE-2019-20807)

請注意，Nessus 依賴供應商報告的套件存在。

執行 MAIN 6.02 版的遠端 NewStart CGSL 主機上安裝的 vim 套件受到一個弱點影響：

  - 在 8.1.0881 之前的 Vim 中，使用者可透過指令碼介面 (例如 Python、Ruby 或 Lua) 規避 rvim 受限模式並執行任意 OS 命令。(CVE-2019-20807)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

遠端 Ubuntu 16.04 LTS/18.04 LTS/20.04 LTS 主機上安裝的套件受到 USN-5147-1 公告中所提及的多個弱點影響。

  - vim 容易受到堆積型緩衝區溢位影響 (CVE-2021-3872、 CVE-2021-3903、 CVE-2021-3927)

  - 8.0.1263 以前的 Vim 中的 fileio.c 會將 .swp 檔案的群組擁有權設定為編輯者的主要群組 (可能與原始檔案的群組擁有權不同)，進而讓本機使用者透過利用適當的群組成員資格來獲得敏感資訊，如 root 擁有的 /etc/shadow 所示：shadow mode 0640，但 root 擁有的 /etc/.shadow.swp 則為：sers mode 0640，與 CVE-2017-1000382 不同的弱點。(CVE-2017-17087)

  - 在 8.1.0881 之前的 Vim 中，使用者可透過指令碼介面 (例如 Python、Ruby 或 Lua) 規避 rvim 受限模式並執行任意 OS 命令。(CVE-2019-20807)

  - vim 容易受到使用未初始化變數的影響 (CVE-2021-3928)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Rocky Linux 8 主機已安裝受 RLSA-2020:4453 公告中所提及一個弱點影響的套件。

  - 在 8.1.0881 之前的 Vim 中，使用者可透過指令碼介面 (例如 Python、Ruby 或 Lua) 規避 rvim 受限模式並執行任意 OS 命令。(CVE-2019-20807)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 CentOS Linux 8 主機上安裝的套件受到 CESA-2020: 4453 公告中所提及的弱點影響。

  - vim：- 在 rvim 受限模式中，使用者可透過指令碼介面執行任意 OS 命令 (CVE-2019-20807)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5147-1 advisory.

    It was discovered that Vim incorrectly handled permissions on the .swp file. A local attacker could     possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 14.04 ESM.
    (CVE-2017-17087)

    It was discovered that Vim incorrectly handled restricted mode. A local attacker could possibly use this     issue to bypass restricted mode and execute arbitrary commands. Note: This update only makes executing     shell commands more difficult. Restricted mode should not be considered a complete security measure. This     issue only affected Ubuntu 14.04 ESM. (CVE-2019-20807)

    Brian Carpenter discovered that vim incorrectly handled memory when opening certain files. If a user was     tricked into opening a specially crafted file, a remote attacker could crash the application, leading to a     denial of service, or possible execute arbitrary code with user privileges. This issue only affected     Ubuntu 20.04 LTS, Ubuntu 21.04 and Ubuntu 21.10. (CVE-2021-3872)

    It was discovered that vim incorrectly handled memory when opening certain files. If a user was tricked     into opening a specially crafted file, a remote attacker could crash the application, leading to a denial     of service, or possible execute arbitrary code with user privileges. (CVE-2021-3903)

    It was discovered that vim incorrectly handled memory when opening certain files. If a user was tricked     into opening a specially crafted file, a remote attacker could crash the application, leading to a denial     of service, or possible execute arbitrary code with user privileges. (CVE-2021-3927)

    It was discovered that vim incorrectly handled memory when opening certain files. If a user was tricked     into opening a specially crafted file, a remote attacker could crash the application, leading to a denial     of service, or possible execute arbitrary code with user privileges. (CVE-2021-3928)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands     via scripting interfaces (e.g., Python, Ruby, or Lua). (CVE-2019-20807)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote NewStart CGSL host, running version MAIN 6.02, has vim packages installed that are affected by a vulnerability:

  - In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands     via scripting interfaces (e.g., Python, Ruby, or Lua). (CVE-2019-20807)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In Vim before 8.1.0881, users can circumvent the rvim     restricted mode and execute arbitrary OS commands via     scripting interfaces (e.g., Python, Ruby, or     Lua).(CVE-2019-20807)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the vim packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - In Vim before 8.1.0881, users can circumvent the rvim     restricted mode and execute arbitrary OS commands via     scripting interfaces (e.g., Python, Ruby, or     Lua).(CVE-2019-20807)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - In Vim before 8.1.0881, users can circumvent the rvim     restricted mode and execute arbitrary OS commands via     scripting interfaces (e.g., Python, Ruby, or     Lua).(CVE-2019-20807)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for vim fixes the following issues :

CVE-2019-20807: Fixed an issue where escaping from the restrictive mode of vim was possible using interfaces (bsc#1172225).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for vim fixes the following issues :

  - CVE-2019-20807: Fixed an issue where escaping from the     restrictive mode of vim was possible using interfaces     (bsc#1172225). 

This update was imported from the SUSE:SLE-15:Update update project.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2020:4453 advisory.

  - In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands     via scripting interfaces (e.g., Python, Ruby, or Lua). (CVE-2019-20807)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4453 advisory.

  - vim: users can execute arbitrary OS commands via scripting interfaces in the rvim restricted mode     (CVE-2019-20807)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
142440	RHEL 8 : vim (RHSA-2020:4453)	Nessus	Red Hat Local Security Checks	2020/11/4	2024/11/8	medium
222796	Linux Distros 未修補弱點：CVE-2019-20807	Nessus	Misc.	2025/3/4	2025/3/4	medium
147392	NewStart CGSL MAIN 6.02：vim 弱點 (NS-SA-2021-0074)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2021/3/11	medium
155351	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS：Vim 弱點 (USN-5147-1)	Nessus	Ubuntu Local Security Checks	2021/11/15	2024/8/28	high
184961	Rocky Linux 8vim (RLSA-2020:4453)	Nessus	Rocky Linux Local Security Checks	2023/11/7	2023/11/7	medium
145865	CentOS 8：vim (CESA-2020: 4453)	Nessus	CentOS Local Security Checks	2021/2/1	2021/3/23	medium
155351	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS : Vim vulnerabilities (USN-5147-1)	Nessus	Ubuntu Local Security Checks	2021/11/15	2024/8/28	high
222796	Linux Distros Unpatched Vulnerability : CVE-2019-20807	Nessus	Misc.	2025/3/4	2025/3/4	medium
147392	NewStart CGSL MAIN 6.02 : vim Vulnerability (NS-SA-2021-0074)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2021/3/11	medium
140155	EulerOS 2.0 SP5 : vim (EulerOS-SA-2020-1934)	Nessus	Huawei Local Security Checks	2020/9/2	2022/11/21	medium
140949	EulerOS Virtualization for ARM 64 3.0.6.0 : vim (EulerOS-SA-2020-2001)	Nessus	Huawei Local Security Checks	2020/9/29	2022/11/21	medium
142512	EulerOS Virtualization 3.0.6.6 : vim (EulerOS-SA-2020-2455)	Nessus	Huawei Local Security Checks	2020/11/6	2024/2/9	medium
137590	SUSE SLED15 / SLES15 Security Update : vim (SUSE-SU-2020:1551-1)	Nessus	SuSE Local Security Checks	2020/6/18	2022/11/21	medium
138676	openSUSE Security Update : vim (openSUSE-2020-794)	Nessus	SuSE Local Security Checks	2020/7/20	2022/11/21	medium
184961	Rocky Linux 8 : vim (RLSA-2020:4453)	Nessus	Rocky Linux Local Security Checks	2023/11/7	2023/11/7	medium
145865	CentOS 8 : vim (CESA-2020:4453)	Nessus	CentOS Local Security Checks	2021/2/1	2021/3/23	medium

检测

插件搜索

medium

medium

medium

high

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium