DescriptionVIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitylow (attack range: local)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
vim (PTS)wheezy2:7.3.547-7vulnerable
wheezy (security)2:7.3.547-7+deb7u4vulnerable
jessie (security)2:7.4.488-7+deb8u2vulnerable
buster, sid2:8.0.1453-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs

vim creates the .swp file according to the permissions of the file being
edited, admitely ignoring the umask, so in the reporters case the .swp
file is readable by others. But that seem to be the intended behaviour.

Search for package or bug name: Reporting problems