{"id":"CVE-2017-1000382","aliases":["DEBIAN-CVE-2017-1000382","EUVD-2017-1541","GHSA-fc3h-fxv9-79gq","UBUNTU-CVE-2017-1000382","openSUSE-SU-2024:11497-1"],"status":"published","title":"VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file (\"...","description":"VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file (\"[ORIGINAL_FILENAME].swp\") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00381,"percentile":0.32327,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2017-10-31T20:00:00Z","modified":"2026-10-24T10:31:01Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:9.0.1378-2","2:9.0.1378-2+deb12u1","2:9.0.1378-2+deb12u2","2:9.0.1658-1","2:9.0.1672-1","2:9.0.1894-1","2:9.0.2018-1","2:9.0.2087-1","2:9.0.2103-1","2:9.0.2116-1","2:9.0.2189-1","2:9.1.0-1","2:9.1.0016-1","2:9.1.0199-1","2:9.1.0374-1","2:9.1.0377-1","2:9.1.0496-1","2:9.1.0698-1","2:9.1.0709-1","2:9.1.0709-2","2:9.1.0777-1","2:9.1.0861-1","2:9.1.0967-1","2:9.1.0967-2","2:9.1.1113-1","2:9.1.1230-1","2:9.1.1230-2","2:9.1.1385-1","2:9.1.1766-1","2:9.1.1829-1","2:9.1.1846-1","2:9.1.1882-1","2:9.1.2103-1","2:9.1.2141-1","2:9.2.0119-1","2:9.2.0136-1","2:9.2.0218-1","2:9.2.0315-1","2:9.2.0338-1","2:9.2.0355-1","2:9.2.0428-1","2:9.2.0461-1","2:9.2.0524-1","2:9.2.0782-1","2:9.2.0858-1"]},{"source":"osv","ecosystem":"Debian:13","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:9.1.1230-2","2:9.1.1385-1","2:9.1.1766-1","2:9.1.1829-1","2:9.1.1846-1","2:9.1.1882-1","2:9.1.2103-1","2:9.1.2141-1","2:9.2.0119-1","2:9.2.0136-1","2:9.2.0218-1","2:9.2.0315-1","2:9.2.0338-1","2:9.2.0355-1","2:9.2.0428-1","2:9.2.0461-1","2:9.2.0524-1","2:9.2.0782-1","2:9.2.0858-1"]},{"source":"osv","ecosystem":"Debian:14","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:9.1.1230-2","2:9.1.1385-1","2:9.1.1766-1","2:9.1.1829-1","2:9.1.1846-1","2:9.1.1882-1","2:9.1.2103-1","2:9.1.2141-1","2:9.2.0119-1","2:9.2.0136-1","2:9.2.0218-1","2:9.2.0315-1","2:9.2.0338-1","2:9.2.0355-1","2:9.2.0428-1","2:9.2.0461-1","2:9.2.0524-1","2:9.2.0782-1","2:9.2.0858-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.3408-1.2"}]}],"bundled":7}],"products":[{"vendor":"vim","product":"vim"}],"references":[{"url":"http://security.cucumberlinux.com/security/details.php?id=120","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2017/10/31/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000382"},{"url":"https://github.com/advisories/GHSA-fc3h-fxv9-79gq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-1000382","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-1000382","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2017/10/31/15","tags":["report"]},{"url":"https://groups.google.com/forum/#!msg/vim_dev/sRT9BtjLWMk/MZyVYhshBwAJ","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-1000382","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12735","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-1000382","description":"VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file (\"[ORIGINAL_FILENAME].swp\") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.","status":"published","published":"2017-10-31T20:00:00Z","modified":"2024-08-05T22:00:41.397Z","updated_at":"2026-11-02T14:33:21.142987Z"}],"euvd":[{"id":"EUVD-2017-1541","description":"VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file (\"[ORIGINAL_FILENAME].swp\") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.","status":"published","published":"2017-10-31T20:00:00Z","modified":"2024-08-05T22:00:41Z","updated_at":"2026-11-03T02:23:03.159581Z"}],"ghsa":[{"id":"GHSA-fc3h-fxv9-79gq","title":"VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file (\"...","description":"VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file (\"[ORIGINAL_FILENAME].swp\") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.","status":"published","published":"2022-05-17T00:21:34Z","modified":"2023-02-03T05:01:32Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:52:59.998713Z"}],"nvd":[{"id":"CVE-2017-1000382","description":"VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file (\"[ORIGINAL_FILENAME].swp\") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.","status":"published","published":"2017-10-31T20:29:00.263Z","modified":"2026-06-17T00:59:04.35Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:04:08.01771Z"}],"osv":[{"id":"CVE-2017-1000382","description":"VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file (\"[ORIGINAL_FILENAME].swp\") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.","status":"published","published":"2017-10-31T20:29:00.263Z","modified":"2026-10-24T10:31:01.401528513Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"DEBIAN-CVE-2017-1000382","description":"VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file (\"[ORIGINAL_FILENAME].swp\") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.","status":"published","published":"2017-10-31T20:29:00.263Z","modified":"2026-09-01T20:02:39.960851058Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"UBUNTU-CVE-2017-1000382","description":"VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file (\"[ORIGINAL_FILENAME].swp\") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.","status":"withdrawn","published":"2017-10-31T20:29:00Z","modified":"2026-07-21T18:18:16.345389561Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"openSUSE-SU-2024:11497-1","title":"gvim-8.2.3408-1.2 on GA media","description":"These are all security issues fixed in the gvim-8.2.3408-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:19:09.391573Z","updated_at":"2026-11-02T16:58:35.195147Z"}]}}