リモートの Oracle Linux 5 ホストに、ELSA-2007-0346 のアドバイザリに記載されている脆弱性の影響を受けるパッケージがインストールされています。

    [7.0.109-3.3]
     - gzip -9n を使用して multilib fileconflict を回避します

     [7.0.109-3.2]
     - root に対して「modeline」をデフォルトでオフにします
     - 解決 4: bz#238259

     [7.0.109-3.1]
     - モードラインの問題を修正します
     - 解決 4: bz#238259

Tenable は、前述の記述ブロックを Oracle Linux セキュリティアドバイザリから直接抽出しています。

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

遠端 Oracle Linux 5 主機中安裝的套件受到 ELSA-2007-0346 公告中提及的一個弱點影響。

    [7.0.109-3.3]
     - 使用 gzip -9n 避免 multilib 檔案衝突

     [7.0.109-3.2]
     - 針對 root 讓「modeline」預設為關閉
     - 解決：bz#238259

     [7.0.109-3.1]
     - 修正 modeline 問題
     - 解決：bz#238259

Tenable 已直接從 Oracle Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 Oracle Linux 5 主机上安装的多个程序包受到 ELSA-2007-0346 公告中提及的一个漏洞影响。

    [7.0.109-3.3]
     - 使用 gzip -9n 避免 multilib 文件冲突

     [7.0.109-3.2]
     - 对于根用户让“modeline”默认为关闭
     - 已解决：bz#238259

     [7.0.109-3.1]
     - 修复 modeline 问题
     - 已解决：bz#238259

Tenable 已直接从 Oracle Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2007-0346 advisory.

    [7.0.109-3.3]
     - use gzip -9n to avoid multilib fileconflicts

     [7.0.109-3.2]
     - Let 'modeline' default to off for root
     - Resolves: bz#238259

     [7.0.109-3.1]
     - fix modeline issues
     - Resolves: bz#238259

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Files with VIM modelines could call some unsafe VIM functions (CVE-2007-2438). Modelines are disabled in the default config (/etc/vimrc) of openSUSE though.

Updated vim packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

VIM (VIsual editor iMproved) is a version of the vi editor.

An arbitrary command execution flaw was found in the way VIM processes modelines. If a user with modelines enabled opened a text file containing a carefully crafted modeline, arbitrary commands could be executed as the user running VIM. (CVE-2007-2438)

Users of VIM are advised to upgrade to these updated packages, which resolve this issue.

Please note: this issue did not affect VIM as distributed with Red Hat Enterprise Linux 2.1, 3, or 4.

Tomas Golembiovsky discovered that some vim commands were accidentally allowed in modelines. By tricking a user into opening a specially crafted file in vim, an attacker could execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability in vim 7.0's modeline processing capabilities was discovered where a user with modelines enabled could open a text file containing a carefully crafted modeline, executing arbitrary commands as the user running vim.

Updated packages have been patched to prevent this issue.

Several vulnerabilities have been discovered in the vim editor. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-2953     Ulf Harnhammar discovered that a format string flaw in     helptags_one() from src/ex_cmds.c (triggered through the     'helptags' command) can lead to the execution of     arbitrary code.

  - CVE-2007-2438     Editors often provide a way to embed editor     configuration commands (aka modelines) which are     executed once a file is opened. Harmful commands are     filtered by a sandbox mechanism. It was discovered that     function calls to writefile(), feedkeys() and system()     were not filtered, allowing shell command execution with     a carefully crafted file opened in vim.

This updated advisory repairs issues with missing files in the packages for the oldstable distribution (sarge) for the alpha, mips, and mipsel architectures.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
67494	Oracle Linux 5Moderate/vimELSA-2007-0346	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	critical
67494	Oracle Linux 5中等/ vim (ELSA-2007-0346)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	critical
67494	Oracle Linux 5Moderate: / vim (ELSA-2007-0346)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	critical
67494	Oracle Linux 5 : Moderate: / vim (ELSA-2007-0346)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	critical
27474	openSUSE 10 Security Update : vim (vim-3410)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	high
25332	RHEL 5 : vim (RHSA-2007:0346)	Nessus	Red Hat Local Security Checks	2007/5/25	2021/1/14	high
28063	Ubuntu 6.10 / 7.04 : vim vulnerability (USN-463-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	high
25191	Mandrake Linux Security Advisory : vim (MDKSA-2007:101)	Nessus	Mandriva Local Security Checks	2007/5/10	2021/1/6	high
25205	CentOS 5 : vim (CESA-2007:0346)	Nessus	CentOS Local Security Checks	2007/5/11	2021/1/4	high
25964	Debian DSA-1364-2 : vim - several vulnerabilities	Nessus	Debian Local Security Checks	2007/9/3	2021/1/4	high

检测

插件搜索

critical

critical

critical

critical

high

high

high

high

high

high