Skip to content
OpenAdvisories
Medium ALAS2-2023-2338 1 CVE

Moderate: vim security update (Amazon Linux 2)

Published Nov 9, 2023 · Updated Nov 15, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-46246: Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the file `src/alloc.c` at line 748, which is freed in the file `src/ex_docmd.c` in the function `do_cmdline` at line 1010 and then used again in `src/cmdhist.c` at line 759. When using the `:history` command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 vim-common 2:9.0.2081-1.amzn2.0.1
Amazon Linux · 2 vim-data 2:9.0.2081-1.amzn2.0.1
Amazon Linux · 2 vim-debuginfo 2:9.0.2081-1.amzn2.0.1
Amazon Linux · 2 vim-enhanced 2:9.0.2081-1.amzn2.0.1
Amazon Linux · 2 vim-filesystem 2:9.0.2081-1.amzn2.0.1
Amazon Linux · 2 vim-minimal 2:9.0.2081-1.amzn2.0.1
Amazon Linux · 2 vim-X11 2:9.0.2081-1.amzn2.0.1
Amazon Linux · 2 xxd 2:9.0.2081-1.amzn2.0.1

Vulnerabilities 1

  • Medium 4.0
    CVE-2023-46246

    Integer Overflow in :history command in Vim

    Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the file `src/alloc.c` at line 748, which is freed in the file `src/ex_docmd.c` in the function `do_cmdline` at line 1010 …

    vim vim vim vim Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-46246.html