Skip to content
OpenAdvisories
Low ALAS2023-2024-469 1 CVE

Low: vim security update (Amazon Linux 2023)

Published Jan 3, 2024 · Updated Jan 8, 2024

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-48706: Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call causes free-ing of memory which may later then be accessed by the initial `:s` command. The user must intentionally execute the payload and the whole process is a bit tricky to do since it seems to work only reliably for the very first :s command. It may also cause a crash of Vim. Version 9.0.2121 contains a fix for this issue.

Fixed packages 12

ReleasePackageFixed in
Amazon Linux · 2023 vim-common 2:9.0.2153-1.amzn2023
Amazon Linux · 2023 vim-data 2:9.0.2153-1.amzn2023
Amazon Linux · 2023 vim-debuginfo 2:9.0.2153-1.amzn2023
Amazon Linux · 2023 vim-debugsource 2:9.0.2153-1.amzn2023
Amazon Linux · 2023 vim-default-editor 2:9.0.2153-1.amzn2023
Amazon Linux · 2023 vim-enhanced 2:9.0.2153-1.amzn2023
Amazon Linux · 2023 vim-enhanced-debuginfo 2:9.0.2153-1.amzn2023
Amazon Linux · 2023 vim-filesystem 2:9.0.2153-1.amzn2023
Amazon Linux · 2023 vim-minimal 2:9.0.2153-1.amzn2023
Amazon Linux · 2023 vim-minimal-debuginfo 2:9.0.2153-1.amzn2023
Amazon Linux · 2023 xxd 2:9.0.2153-1.amzn2023
Amazon Linux · 2023 xxd-debuginfo 2:9.0.2153-1.amzn2023

Vulnerabilities 1

  • Low 3.6

    Vim has heap-use-after-free at /src/charset.c:1770:12 in skipwhite

    Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call…

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-48706.html