Skip to content
OpenAdvisories
Medium ALAS2-2024-2452 2 CVEs

Moderate: vim security update (Amazon Linux 2)

Published Feb 15, 2024 · Updated Feb 29, 2024

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-22667: Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions. CVE-2023-48706: Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call causes free-ing of memory which may later then be accessed by the initial `:s` command. The user must intentionally execute the payload and the whole process is a bit tricky to do since it seems to work only reliably for the very first :s command. It may also cause a crash of Vim. Version 9.0.2121 contains a fix for this issue.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 vim-common 2:9.0.2153-1.amzn2.0.1
Amazon Linux · 2 vim-data 2:9.0.2153-1.amzn2.0.1
Amazon Linux · 2 vim-debuginfo 2:9.0.2153-1.amzn2.0.1
Amazon Linux · 2 vim-enhanced 2:9.0.2153-1.amzn2.0.1
Amazon Linux · 2 vim-filesystem 2:9.0.2153-1.amzn2.0.1
Amazon Linux · 2 vim-minimal 2:9.0.2153-1.amzn2.0.1
Amazon Linux · 2 vim-X11 2:9.0.2153-1.amzn2.0.1
Amazon Linux · 2 xxd 2:9.0.2153-1.amzn2.0.1

Vulnerabilities 2

  • High 7.8

    Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the er…

  • Low 3.6

    Vim has heap-use-after-free at /src/charset.c:1770:12 in skipwhite

    Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call…

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-48706.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-22667.html