CVE-2017-1000382

NameCVE-2017-1000382
DescriptionVIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitylow (attack range: local)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
vim (PTS)jessie2:7.4.488-7+deb8u3vulnerable
jessie (security)2:7.4.488-7+deb8u2vulnerable
stretch2:8.0.0197-4+deb9u1vulnerable
buster, sid2:8.1.0549-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
vimsource(unstable)(unfixed)unimportant

Notes

http://www.openwall.com/lists/oss-security/2017/10/31/15
Cf. http://www.openwall.com/lists/oss-security/2017/11/01/4
vim creates the .swp file according to the permissions of the file being
edited, admitely ignoring the umask, so in the reporters case the .swp
file is readable by others. But that seem to be the intended behaviour.

Search for package or bug name: Reporting problems