CVE-2008-3075
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted...
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a ZIP archive and possibly (2) the filename of the first file in a ZIP archive, which is not properly handled by zip.vim in the VIM ZIP plugin (zipPlugin.vim) v.11 through v.21, as demonstrated by the zipplugin and zipplugin.v2 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3074. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.
Exploit likelihood
What each source reports
NVD Score used
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a ZIP archive and possibly (2) the filename of the first file in a ZIP archive, which is not properly handled by zip.vim in the VIM ZIP plugin (zipPlugin.vim) v.11 through v.21, as demonstrated by the zipplugin and zipplugin.v2 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3074. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.
- Record
CVE-2008-3075- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a ZIP archive and possibly (2) the filename of the first file in a ZIP archive, which is not properly handled by zip.vim in the VIM ZIP plugin (zipPlugin.vim) v.11 through v.21, as demonstrated by the zipplugin and zipplugin.v2 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3074. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.
- Record
CVE-2008-3075- Updated
- 2026-11-02
EUVDEUVD-2008-3065 No score
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a ZIP archive and possibly (2) the filename of the first file in a ZIP archive, which is not properly handled by zip.vim in the VIM ZIP plugin (zipPlugin.vim) v.11 through v.21, as demonstrated by the zipplugin and zipplugin.v2 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3074. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.
- Record
EUVD-2008-3065- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wqmg-q854-x6x6 No score
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted...
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a ZIP archive and possibly (2) the filename of the first file in a ZIP archive, which is not properly handled by zip.vim in the VIM ZIP plugin (zipPlugin.vim) v.11 through v.21, as demonstrated by the zipplugin and zipplugin.v2 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3074. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.
- Record
GHSA-wqmg-q854-x6x6- Weakness
- CWE-94
- Updated
- 2026-11-02
OSV No score
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a ZIP archive and possibly (2) the filename of the first file in a ZIP archive, which is not properly handled by zip.vim in the VIM ZIP plugin (zipPlugin.vim) v.11 through v.21, as demonstrated by the zipplugin and zipplugin.v2 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3074. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.
- Record
CVE-2008-3075- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-3075 No score
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a ZIP archive and possibly (2) the filename of the first file in a ZIP archive, which is not properly handled by zip.vim in the VIM ZIP plugin (zipPlugin.vim) v.11 through v.21, as demonstrated by the zipplugin and zipplugin.v2 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3074. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.
- Record
DEBIAN-CVE-2008-3075- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vimDebian:12 |
before 2:7.2.010-1 | 2:7.2.010-1 |
vimDebian:13 |
before 2:7.2.010-1 | 2:7.2.010-1 |
vimDebian:14 |
before 2:7.2.010-1 | 2:7.2.010-1 |
vimDebian:4.0 From an advisory covering 5 CVEs |
before 1:7.0-122+1etch5, plus listed versions 1:7.0-122+1etch21:7.0-122+1etch31:7.0-122+1etch4 |
1:7.0-122+1etch5 |
vimRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 2:7.0.109-4.el5_2.4z | 2:7.0.109-4.el5_2.4z |
vim-X11Red Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 2:7.0.109-4.el5_2.4z | 2:7.0.109-4.el5_2.4z |
vim-commonRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 2:7.0.109-4.el5_2.4z | 2:7.0.109-4.el5_2.4z |
vim-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 2:7.0.109-4.el5_2.4z | 2:7.0.109-4.el5_2.4z |
vim-enhancedRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 2:7.0.109-4.el5_2.4z | 2:7.0.109-4.el5_2.4z |
vim-minimalRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 2:7.0.109-4.el5_2.4z | 2:7.0.109-4.el5_2.4z |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
vimRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 2:7.0.109-4.el5_2.4z | 2:7.0.109-4.el5_2.4z |
vim-X11Red Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 2:7.0.109-4.el5_2.4z | 2:7.0.109-4.el5_2.4z |
vim-commonRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 2:7.0.109-4.el5_2.4z | 2:7.0.109-4.el5_2.4z |
vim-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 2:7.0.109-4.el5_2.4z | 2:7.0.109-4.el5_2.4z |
vim-enhancedRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 2:7.0.109-4.el5_2.4z | 2:7.0.109-4.el5_2.4z |
vim-minimalRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs |
before 2:7.0.109-4.el5_2.4z | 2:7.0.109-4.el5_2.4z |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-3075 is a high vulnerability (CVSS 9.3) in Vim, published February 21, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.26%, the 91st percentile. Fixed in vim 2:7.2.010-1.
References
lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
rdancer.org/vulnerablevim.html
openwall.com/lists/oss-security/2008/07/15/4
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10246
Show 42 moreShow less
redhat.com/support/errata/RHSA-2008-0580.html
secunia.com/advisories/34418
wiki.rpath.com/wiki/Advisories:rPSA-2008-0324
marc.info?l=bugtraq&m=121494431426308&w=2
bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919
bugzilla.redhat.com/show_bug.cgi?id=467432
mandriva.com/security/advisories?name=MDVSA-2008:236
securityfocus.com/bid/32463
nvd.nist.gov/vuln/detail/CVE-2008-3075
github.com/advisories/GHSA-wqmg-q854-x6x6
security-tracker.debian.org/tracker/CVE-2008-3075
access.redhat.com/errata/RHSA-2008:0580
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0580.json
cve.org/CVERecord?id=CVE-2007-2953