Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-1355: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402. CVE-2023-1264: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392. CVE-2023-1175: Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378. CVE-2023-1170: A heap-based buffer overflow vulnerability was found in GitHub repository vim/vim prior to 9.0.1376 in Vim's utf_ptr2char() function of the src/mbyte.c file. This flaw occurs because there is access to invalid memory with put in visual block mode. An attacker can trick a user into opening a specially crafted file, triggering an out-of-bounds read that causes an application to crash, leading to a denial of service.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | vim-common | 2:9.0.1403-1.amzn2.0.1 |
| Amazon Linux · 2 | vim-data | 2:9.0.1403-1.amzn2.0.1 |
| Amazon Linux · 2 | vim-debuginfo | 2:9.0.1403-1.amzn2.0.1 |
| Amazon Linux · 2 | vim-enhanced | 2:9.0.1403-1.amzn2.0.1 |
| Amazon Linux · 2 | vim-filesystem | 2:9.0.1403-1.amzn2.0.1 |
| Amazon Linux · 2 | vim-minimal | 2:9.0.1403-1.amzn2.0.1 |
| Amazon Linux · 2 | vim-X11 | 2:9.0.1403-1.amzn2.0.1 |
Vulnerabilities 4
-
High 8.4
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402.
-
High 7.3
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.
-
High 7.3
Incorrect Calculation of Buffer Size in vim/vim
Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.
-
Medium 6.6
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392.