| Title | Syntastic におけるデータ処理に関する脆弱性 |
|---|---|
| Summary | Syntastic (別名 vim-syntastic) には、データ処理に関する脆弱性が存在します。 |
| Possible impacts | 情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。 |
| Solution | ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date | April 17, 2018, midnight |
| Registration Date | July 13, 2018, 4:46 p.m. |
| Last Update | July 13, 2018, 4:46 p.m. |
| CVSS3.0 : 重要 | |
| Score | 7.5 |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CVSS2.0 : 危険 | |
| Score | 8.5 |
|---|---|
| Vector | AV:N/AC:M/Au:S/C:C/I:C/A:C |
| Syntastic project |
| Syntastic 3.9.0 まで |
| No | Changed Details | Date of change |
|---|---|---|
| 1 | [2018年07月13日] 掲載 |
July 13, 2018, 4:46 p.m. |
| Summary | Syntastic (aka vim-syntastic) through 3.9.0 does not properly handle searches for configuration files (it searches the current directory up to potentially the root). This improper handling might be exploited for arbitrary code execution via a malicious gcc plugin, if an attacker has write access to a directory that is a parent of the base directory of the project being checked. NOTE: exploitation is more difficult after 3.8.0 because filename prediction may be needed. |
|---|---|
| Publication Date | May 21, 2018, 5:29 a.m. |
| Registration Date | March 1, 2021, 6:45 p.m. |
| Last Update | Nov. 21, 2024, 12:43 p.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:syntastic_project:syntastic:*:*:*:*:*:vim:*:* | 3.9.0 | ||||
| Configuration2 | or higher | or less | more than | less than | |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | |||||