CVE-2008-3294: Vim

Low severity, CVSS 3.7. EPSS: 4.5% chance of exploitation in the next 30 days.

src/configure.in in Vim 5.0 through 7.1, when used for a build with Python support, does not ensure that the Makefile-conf temporary file has the intended ownership and permissions, which allows local users to execute arbitrary code by modifying this file during a time window, or by creating it ahead of time with permissions that prevent its modification by configure.

Affected products

• Vim Vim: version 5.0 only; version 5.1 only; version 5.2 only; version 5.3 only; version 5.4 only; version 5.5 only; …

Published 2008-07-24. Last modified 2026-06-16.