CVE-2017-1000382

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-10-31 · updated 2026-06-17
Weakness: CWE-200

Description

VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.

Affected products

vim/vim: through 8.0.1187

References

http://security.cucumberlinux.com/security/details.php?id=120
http://www.openwall.com/lists/oss-security/2017/10/31/1
http://security.cucumberlinux.com/security/details.php?id=120
http://www.openwall.com/lists/oss-security/2017/10/31/1

Get alerted when CVE-2017-1000382 or the next vulnerability affects your stack