CVE catalog

CVE-2017-17087

vim: CVE-2017-17087

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.36% · Oct 25, 2026

fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the group ownership of the original file), which allows local users to obtain sensitive information by leveraging an applicable group membership, as demonstrated by /etc/shadow owned by root:shadow mode 0640, but /etc/.shadow.swp owned by root:users mode 0640, a different vulnerability than CVE-2017-1000382.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianvimsid2:9.2.0858-1fixed
Debianvimforky2:9.2.0858-1fixed
Debianvimtrixie2:9.1.1230-2fixed
Debianvimbookworm2:9.0.1378-2+deb12u2fixed
Ubuntuvimpro2:7.4.712-2ubuntu4vulnerable
Ubuntuvimpro2:7.4.826-1ubuntu1vulnerable
Ubuntuvimpro2:7.4.826-1ubuntu2vulnerable
Ubuntuvimpro2:7.4.826-1ubuntu3vulnerable
Ubuntuvimpro2:7.4.963-1ubuntu1vulnerable
Ubuntuvimpro2:7.4.963-1ubuntu4vulnerable
Ubuntuvimpro2:7.4.963-1ubuntu5vulnerable
Ubuntuvimpro2:7.4.1689-3ubuntu1vulnerable
Ubuntuvimpro2:7.4.1689-3ubuntu1.1vulnerable
Ubuntuvimpro2:7.4.1689-3ubuntu1.2vulnerable
Ubuntuvimpro2:7.4.1689-3ubuntu1.3vulnerable
Ubuntuvimpro2:7.4.1689-3ubuntu1.4vulnerable
Ubuntuvimpro2:7.4.1689-3ubuntu1.5vulnerable
Ubuntuvimpro2:7.4.1689-3ubuntu1.5+esm2vulnerable
Ubuntuvimpro2:7.4.1689-3ubuntu1.5+esm3fixed
Ubuntuvim18.042:8.0.0197-4ubuntu5vulnerable
Ubuntuvim18.042:8.0.1144-1ubuntu1vulnerable
Ubuntuvim18.042:8.0.1401-1ubuntu1vulnerable
Ubuntuvim18.042:8.0.1401-1ubuntu2vulnerable
Ubuntuvim18.042:8.0.1401-1ubuntu3vulnerable
Ubuntuvim18.042:8.0.1453-1ubuntu1vulnerable
Ubuntuvim18.042:8.0.1453-1ubuntu1.1vulnerable
Ubuntuvim18.042:8.0.1453-1ubuntu1.3vulnerable
Ubuntuvim18.042:8.0.1453-1ubuntu1.4vulnerable
Ubuntuvim18.042:8.0.1453-1ubuntu1.6vulnerable
Ubuntuvim18.042:8.0.1453-1ubuntu1.7fixed
Ubuntuvim20.042:8.1.0875-5ubuntu2vulnerable
Ubuntuvim20.042:8.1.0875-5ubuntu3vulnerable
Ubuntuvim20.042:8.1.0875-5ubuntu4vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu1vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu4vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.3vulnerable
Ubuntuvim20.042:8.1.2269-1ubuntu5.4fixed
Ubuntuvim16.042:7.4.712-2ubuntu4vulnerable
Ubuntuvim16.042:7.4.826-1ubuntu1vulnerable
Ubuntuvim16.042:7.4.826-1ubuntu2vulnerable
Ubuntuvim16.042:7.4.826-1ubuntu3vulnerable
Ubuntuvim16.042:7.4.963-1ubuntu1vulnerable
Ubuntuvim16.042:7.4.963-1ubuntu4vulnerable
Ubuntuvim16.042:7.4.963-1ubuntu5vulnerable
Ubuntuvim16.042:7.4.1689-3ubuntu1vulnerable
Ubuntuvim16.042:7.4.1689-3ubuntu1.1vulnerable
Ubuntuvim16.042:7.4.1689-3ubuntu1.2vulnerable
Ubuntuvim16.042:7.4.1689-3ubuntu1.3vulnerable
Ubuntuvim16.042:7.4.1689-3ubuntu1.4vulnerable
Ubuntuvim16.042:7.4.1689-3ubuntu1.5fixed
Ubuntuvim18.042:8.0.0197-4ubuntu5vulnerable
Ubuntuvim18.042:8.0.1144-1ubuntu1vulnerable
Ubuntuvim18.042:8.0.1401-1ubuntu1vulnerable
Ubuntuvim18.042:8.0.1401-1ubuntu2vulnerable
Ubuntuvim18.042:8.0.1401-1ubuntu3vulnerable
Ubuntuvim18.042:8.0.1453-1ubuntu1vulnerable
Ubuntuvim18.042:8.0.1453-1ubuntu1.1vulnerable
Ubuntuvim18.042:8.0.1453-1ubuntu1.3vulnerable
Ubuntuvim18.042:8.0.1453-1ubuntu1.4fixed
Ubuntuvimpro2:7.4.000-1ubuntu2vulnerable
Ubuntuvimpro2:7.4.052-1ubuntu1vulnerable
Ubuntuvimpro2:7.4.052-1ubuntu2vulnerable
Ubuntuvimpro2:7.4.052-1ubuntu3vulnerable
Ubuntuvimpro2:7.4.052-1ubuntu3.1vulnerable
Ubuntuvimpro2:7.4.052-1ubuntu3.1+esm1vulnerable
Ubuntuvimpro2:7.4.052-1ubuntu3.1+esm3vulnerable
Ubuntuvimpro2:7.4.052-1ubuntu3.1+esm4fixed
Ubuntuvim16.042:7.4.712-2ubuntu4vulnerable
Ubuntuvim16.042:7.4.826-1ubuntu1vulnerable
Ubuntuvim16.042:7.4.826-1ubuntu2vulnerable
Ubuntuvim16.042:7.4.826-1ubuntu3vulnerable
Ubuntuvim16.042:7.4.963-1ubuntu1vulnerable
Ubuntuvim16.042:7.4.963-1ubuntu4vulnerable
Ubuntuvim16.042:7.4.963-1ubuntu5vulnerable
Ubuntuvim16.042:7.4.1689-3ubuntu1vulnerable
Ubuntuvim16.042:7.4.1689-3ubuntu1.1vulnerable
Ubuntuvim16.042:7.4.1689-3ubuntu1.2vulnerable
Ubuntuvim16.042:7.4.1689-3ubuntu1.3vulnerable
Ubuntuvim16.042:7.4.1689-3ubuntu1.4vulnerable
Ubuntuvim16.042:7.4.1689-3ubuntu1.5fixed
Susevimlinux enterprise module for basesystem 15 sp38.2.5038-150000.5.21.1fixed
Susevimlinux enterprise module for basesystem 15 sp48.2.5038-150000.5.21.1fixed
Susevimlinux enterprise module for desktop applications 15 sp38.2.5038-150000.5.21.1fixed
Susevimlinux enterprise module for desktop applications 15 sp48.2.5038-150000.5.21.1fixed
Susevimlinux enterprise high performance computing 15-espos8.2.5038-150000.5.21.1fixed
Susevimlinux enterprise high performance computing 15-ltss8.2.5038-150000.5.21.1fixed
Susevimlinux enterprise high performance computing 15 sp1-espos8.2.5038-150000.5.21.1fixed
Susevimlinux enterprise high performance computing 15 sp1-ltss8.2.5038-150000.5.21.1fixed
Susevimlinux enterprise high performance computing 15 sp2-espos8.2.5038-150000.5.21.1fixed
Susevimlinux enterprise high performance computing 15 sp2-ltss8.2.5038-150000.5.21.1fixed
Susevimlinux enterprise server 15-ltss8.2.5038-150000.5.21.1fixed
Susevimlinux enterprise server 15 sp1-bcl8.2.5038-150000.5.21.1fixed
Susevimlinux enterprise server 15 sp1-ltss8.2.5038-150000.5.21.1fixed
Susevimlinux enterprise server 15 sp2-bcl8.2.5038-150000.5.21.1fixed
Susevimlinux enterprise server 15 sp2-ltss8.2.5038-150000.5.21.1fixed
Susevimlinux enterprise server for sap applications 158.2.5038-150000.5.21.1fixed
Susevimlinux enterprise server for sap applications 15 sp18.2.5038-150000.5.21.1fixed
Susevimlinux enterprise server for sap applications 15 sp28.2.5038-150000.5.21.1fixed
Susevimmanager proxy 4.18.2.5038-150000.5.21.1fixed
Susevimmanager retail branch server 4.18.2.5038-150000.5.21.1fixed
Susevimmanager server 4.18.2.5038-150000.5.21.1fixed
Susevimlinux enterprise micro 5.18.2.5038-150000.5.21.1fixed
Susevimlinux enterprise micro 5.28.2.5038-150000.5.21.1fixed
Susevimenterprise storage 68.2.5038-150000.5.21.1fixed
Susevimenterprise storage 78.2.5038-150000.5.21.1fixed
Opensusevimleap 15.38.2.5038-150000.5.21.1fixed
Opensusevimleap 15.48.2.5038-150000.5.21.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianvimsourcesid2:8.0.1401-1not yet assignedNot reportedNot reported
Debianvimsourceforky2:8.0.1401-1not yet assignedNot reportedNot reported
Debianvimsourcetrixie2:8.0.1401-1not yet assignedNot reportedNot reported
Debianvimsourcebookworm2:8.0.1401-1not yet assignedNot reportedNot reported
Ubuntuvimdebpro2:7.4.1689-3ubuntu1.5+esm3Not reportedUSN-5147-1Not reported
Ubuntuvimdeb18.042:8.0.1453-1ubuntu1.7Not reportedUSN-5147-1Not reported
Ubuntuvimdeb20.042:8.1.2269-1ubuntu5.4Not reportedUSN-5147-1Not reported
Ubuntuvimdeb16.042:7.4.1689-3ubuntu1.5Not reportedUSN-4582-1Not reported
Ubuntuvimdeb18.042:8.0.1453-1ubuntu1.4Not reportedUSN-4582-1Not reported
Ubuntuvimdebpro2:7.4.052-1ubuntu3.1+esm4Not reportedUBUNTU-CVE-2017-17087Not reported
Ubuntuvimdeb16.042:7.4.1689-3ubuntu1.5Not reportedUBUNTU-CVE-2017-17087Not reported
Susevimrpmlinux enterprise module for basesystem 15 sp38.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmlinux enterprise module for basesystem 15 sp48.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmlinux enterprise module for desktop applications 15 sp38.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmlinux enterprise module for desktop applications 15 sp48.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmlinux enterprise high performance computing 15-espos8.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmlinux enterprise high performance computing 15-ltss8.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmlinux enterprise high performance computing 15 sp1-espos8.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmlinux enterprise high performance computing 15 sp1-ltss8.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmlinux enterprise high performance computing 15 sp2-espos8.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmlinux enterprise high performance computing 15 sp2-ltss8.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmlinux enterprise server 15-ltss8.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmlinux enterprise server 15 sp1-bcl8.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmlinux enterprise server 15 sp1-ltss8.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmlinux enterprise server 15 sp2-bcl8.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmlinux enterprise server 15 sp2-ltss8.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmlinux enterprise server for sap applications 158.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmlinux enterprise server for sap applications 15 sp18.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmlinux enterprise server for sap applications 15 sp28.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmmanager proxy 4.18.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmmanager retail branch server 4.18.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmmanager server 4.18.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmlinux enterprise micro 5.18.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmlinux enterprise micro 5.28.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmenterprise storage 68.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Susevimrpmenterprise storage 78.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Opensusevimrpmleap 15.38.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported
Opensusevimrpmleap 15.48.2.5038-150000.5.21.1Not reportedSUSE-SU-2022:2102-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [vim]Fixed
    Details (2)
    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

  • [vim-athena]Fixed

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

  • [vim-common]Fixed

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

  • [vim-doc]Fixed

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

  • [vim-gtk3]Fixed

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

  • Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

  • [vim-motif]Fixed

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

  • [vim-nox]Fixed

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

  • Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · all · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

  • [vim-tiny]Fixed

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

  • [xxd]Fixed

    Source package: [vim]

    Details (2)
    • 2:9.0.1378-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

    • 2:9.0.1378-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · bookworm; dsa · vim · debian · 12

[Debian 13 (Trixie)]

  • [vim]Fixed
    Details (2)
    • 2:9.1.1230-2 · amd64 · trixie

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · 13

  • [vim-athena]Fixed

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · all · trixie

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · 13

  • [vim-common]Fixed

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · all · trixie

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · 13

  • [vim-doc]Fixed

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · all · trixie

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · 13

  • [vim-gtk3]Fixed

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · amd64 · trixie

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · 13

  • Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · all · trixie

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · 13

  • [vim-motif]Fixed

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · amd64 · trixie

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · 13

  • [vim-nox]Fixed

    Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · amd64 · trixie

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · 13

    • 2:9.1.1230-2 · arm64 · trixie

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · 13

  • Source package: [vim]

    Details (2)
    • 2:9.1.1230-2 · all · trixie

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · 13

    • 2:9.1.1230-2 · all · trixie

      Fixed · Fixed: 2:8.0.1401-1

      dsa · vim · debian · 13

Next results

Observed:

References