Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-0512: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247. CVE-2023-0433: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225. CVE-2023-0288: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. CVE-2023-0054: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. CVE-2023-0051: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. CVE-2022-47024: A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thru 9.0.0339 allows attackers to cause denial of service or other unspecified impacts. CVE-2022-3491: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742. CVE-2022-3352: Use After Free in GitHub repository vim/vim prior to 9.0.0614. CVE-2022-3324: Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598. CVE-2022-3297: Use After Free in GitHub repository vim/vim prior to 9.0.0579. CVE-2022-3296: Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577. CVE-2022-3278: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552. CVE-2022-3256: Use After Free in GitHub repository vim/vim prior to 9.0.0530. CVE-2022-3235: Use After Free in GitHub repository vim/vim prior to 9.0.0490. CVE-2022-3234: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483.
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | vim-common | 2:9.0.1314-1.amzn2023.0.2 |
| Amazon Linux · 2023 | vim-common-debuginfo | 2:9.0.1314-1.amzn2023.0.2 |
| Amazon Linux · 2023 | vim-data | 2:9.0.1314-1.amzn2023.0.2 |
| Amazon Linux · 2023 | vim-debuginfo | 2:9.0.1314-1.amzn2023.0.2 |
| Amazon Linux · 2023 | vim-debugsource | 2:9.0.1314-1.amzn2023.0.2 |
| Amazon Linux · 2023 | vim-default-editor | 2:9.0.1314-1.amzn2023.0.2 |
| Amazon Linux · 2023 | vim-enhanced | 2:9.0.1314-1.amzn2023.0.2 |
| Amazon Linux · 2023 | vim-enhanced-debuginfo | 2:9.0.1314-1.amzn2023.0.2 |
| Amazon Linux · 2023 | vim-filesystem | 2:9.0.1314-1.amzn2023.0.2 |
| Amazon Linux · 2023 | vim-minimal | 2:9.0.1314-1.amzn2023.0.2 |
| Amazon Linux · 2023 | vim-minimal-debuginfo | 2:9.0.1314-1.amzn2023.0.2 |
Vulnerabilities 15
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0490.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0530.
-
High 7.8
Stack-based Buffer Overflow in vim/vim
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0579.
-
High 7.8
Stack-based Buffer Overflow in vim/vim
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598.
-
High 7.8
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.0614.
-
High 7.8
A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thr…
-
High 7.8
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225.
-
High 7.3
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.
-
High 7.3
Out-of-bounds Write in vim/vim
Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.
-
High 7.3
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.
-
High 7.3
Divide By Zero in vim/vim
Divide By Zero in GitHub repository vim/vim prior to 9.0.1247.
-
Medium 6.8
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552.
-
Medium 4.0
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3234.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3235.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3256.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3278.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3296.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3297.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3324.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3352.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3491.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-47024.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-0051.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-0054.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-0288.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-0433.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-0512.html