CVE-2017-1000382
Publication date 31 October 2017
Last updated 6 August 2026
Ubuntu priority
Description
VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| vim | ||
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty |
Not affected
|
Notes
leosilva
I could reproduce following openwall steps after apply the patch community put available and repeat the steps in openwall I still got the same bug behaviour so not sure if patch fix it waiting any comment from community I could confirm with upstream the patch debian put available from upstream doesn't fix the issue
msalvatore
Bram Moolenar (vim's BDFL) had this to say: 1) The permissions are the same as the original file, and that is exactly how it should be. 2) This is working as intended, Vim does not use umask this way. Umask is only used by simple commands such as cp, not by long running processes that deal with many files. Problem is with the user expectations.
mdeslaur
This issue has been disputed by vim developers, marking as not-affected.
Severity score breakdown
CVSS version: CVSS v3.0
Base score
5.5 · Medium
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N