vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.
{ "vanir_signatures": [ { "signature_version": "v1", "target": { "file": "src/nvim/option.c" }, "signature_type": "Line", "source": "https://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba72795040", "deprecated": false, "digest": { "line_hashes": [ "119352792061965424700312121066996025172", "113857948405871672700771365037189680240", "142360316290922043414275534114069859721", "258946919690697244676510402038215312110", "197175263855588805001761100700219762276", "202583343892300000341862322822387722085", "255463265850523179792888946130841740294", "52223540231872929353448838726244965766", "256702904158507026046391767248041921894", "237094371067735568137138369942056152113", "3640628306225217519628167657651154754" ], "threshold": 0.9 }, "id": "CVE-2016-1248-1cfbf7b5" }, { "signature_version": "v1", "target": { "function": "did_set_string_option", "file": "src/nvim/option.c" }, "signature_type": "Function", "source": "https://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba72795040", "deprecated": false, "digest": { "length": 17286.0, "function_hash": "301366598286359872368192811045641113676" }, "id": "CVE-2016-1248-2f4b5847" }, { "signature_version": "v1", "target": { "file": "src/version.c" }, "signature_type": "Line", "source": "https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39a", "deprecated": false, "digest": { "line_hashes": [ "146200493773228420153804765641940418619", "163496322949703359277719742619172258626", "11035514305691661997919675983423628722", "236379829886840980683547539154054541046" ], "threshold": 0.9 }, "id": "CVE-2016-1248-31527657" }, { "signature_version": "v1", "target": { "function": "did_set_string_option", "file": "src/option.c" }, "signature_type": "Function", "source": "https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39a", "deprecated": false, "digest": { "length": 25137.0, "function_hash": "237713869508181487244104230301262360494" }, "id": "CVE-2016-1248-cdbf12be" }, { "signature_version": "v1", "target": { "file": "src/option.c" }, "signature_type": "Line", "source": "https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39a", "deprecated": false, "digest": { "line_hashes": [ "119352792061965424700312121066996025172", "113857948405871672700771365037189680240", "142360316290922043414275534114069859721", "159875579416788555664861351130126303211", "200724304638239168485077721723988743762", "264219115170684188625113930542663995699", "158884868440292541075907460758119556681", "92441425642468386308875131715677257013", "277568945758953787614318102629566609760", "112013201238083825055100230546992630571" ], "threshold": 0.9 }, "id": "CVE-2016-1248-e83de902" } ] }