VULNERABILITY INTELLIGENCE

CVE-2008-3294

CVSS score3.7 LOW
EPSS probability4.50%
CISA KEVNot currently listed
Published2008-07-24
Last modified2026-06-16
CVSS vectorAV:L/AC:H/Au:N/C:P/I:P/A:P

Description

src/configure.in in Vim 5.0 through 7.1, when used for a build with Python support, does not ensure that the Makefile-conf temporary file has the intended ownership and permissions, which allows local users to execute arbitrary code by modifying this file during a time window, or by creating it ahead of time with permissions that prevent its modification by configure.

Weakness classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references