CVE-2009-0316 Code injection in n/a

What is CVE-2009-0316?

CVE-2009-0316 is a medium-severity code injection vulnerability in Vim Vim, published on 28 Jan 2009. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Untrusted search path vulnerability in src/if_python.c in the Python interface in Vim before 7.2.045 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983), as demonstrated by an erroneous search path for plugin/bike.vim in bicyclerepair.

Which versions are affected by CVE-2009-0316?

It affects 1 product.

Products include Vim Vim.

How do I fix CVE-2009-0316?

Upgrade to a fixed version.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2009-0316 being exploited?

There is no known exploitation of CVE-2009-0316 in the wild and no public exploit code.

Other vulnerabilities in Vim Vim

• CVE-2020-20703 Memory corruption in n/a Critical 9.8
• CVE-2017-6349 Integer overflow in n/a Critical 9.8
• CVE-2017-6350 Integer overflow in n/a Critical 9.8
• CVE-2017-5953 Integer overflow in n/a Critical 9.8
• CVE-2008-3075 Command injection in n/a Critical 9.3

All Vim Vim vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2009-0316, GHSA-x433-429v-9473, openSUSE-SU-2024:10234-1.