Skip to content
OpenAdvisories
Medium ALAS2-2025-2753 1 CVE

Moderate: vim security update (Amazon Linux 2)

Published Feb 12, 2025 · Updated Feb 25, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-24014: Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 vim-common 2:9.0.2153-1.amzn2.0.3
Amazon Linux · 2 vim-data 2:9.0.2153-1.amzn2.0.3
Amazon Linux · 2 vim-debuginfo 2:9.0.2153-1.amzn2.0.3
Amazon Linux · 2 vim-enhanced 2:9.0.2153-1.amzn2.0.3
Amazon Linux · 2 vim-filesystem 2:9.0.2153-1.amzn2.0.3
Amazon Linux · 2 vim-minimal 2:9.0.2153-1.amzn2.0.3
Amazon Linux · 2 vim-X11 2:9.0.2153-1.amzn2.0.3
Amazon Linux · 2 xxd 2:9.0.2153-1.amzn2.0.3

Vulnerabilities 1

  • Medium 4.2
    CVE-2025-24014

    segmentation fault in win_line() in Vim < 9.1.1043

    Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the funct…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-24014.html