Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-22667: Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions. CVE-2023-48706: Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call causes free-ing of memory which may later then be accessed by the initial `:s` command. The user must intentionally execute the payload and the whole process is a bit tricky to do since it seems to work only reliably for the very first :s command. It may also cause a crash of Vim. Version 9.0.2121 contains a fix for this issue.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | vim-common | 2:9.0.2153-1.amzn2.0.1 |
| Amazon Linux · 2 | vim-data | 2:9.0.2153-1.amzn2.0.1 |
| Amazon Linux · 2 | vim-debuginfo | 2:9.0.2153-1.amzn2.0.1 |
| Amazon Linux · 2 | vim-enhanced | 2:9.0.2153-1.amzn2.0.1 |
| Amazon Linux · 2 | vim-filesystem | 2:9.0.2153-1.amzn2.0.1 |
| Amazon Linux · 2 | vim-minimal | 2:9.0.2153-1.amzn2.0.1 |
| Amazon Linux · 2 | vim-X11 | 2:9.0.2153-1.amzn2.0.1 |
| Amazon Linux · 2 | xxd | 2:9.0.2153-1.amzn2.0.1 |
Vulnerabilities 2
-
High 7.8
Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the er…
-
Low 3.6
Vim has heap-use-after-free at /src/charset.c:1770:12 in skipwhite
Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call…