Skip to content
OpenAdvisories
High USN-6557-1 14 CVEs

vim vulnerabilities

Published Dec 14, 2023 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Vim could be made to dereference invalid memory. An
attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04
LTS. (CVE-2022-1725)

It was discovered that Vim could be made to recurse infinitely. An
attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1771)

It was discovered that Vim could be made to write out of bounds with a put
command. An attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. This issue only affected Ubuntu 22.04
LTS. (CVE-2022-1886)

It was discovered that Vim could be made to write out of bounds. An
attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu
18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1897,
CVE-2022-2000)

It was discovered that Vim did not properly manage memory in the spell
command. An attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. This issue only affected Ubuntu 22.04
LTS. (CVE-2022-2042)

It was discovered that Vim did not properly manage memory. An attacker
could possibly use this issue to cause a denial of service or execute
arbitrary code. (CVE-2023-46246, CVE-2023-48231)

It was discovered that Vim could be made to divide by zero. An attacker
could possibly use this issue to cause a denial of service. This issue
only affected Ubuntu 23.04 and Ubuntu 23.10. (CVE-2023-48232)

It was discovered that Vim contained multiple arithmetic overflows. An
attacker could possibly use these issues to cause a denial of service.
(CVE-2023-48233, CVE-2023-48234, CVE-2023-48235, CVE-2023-48236,
CVE-2023-48237)

It was discovered that Vim did not properly manage memory in the
substitute command. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. This issue only affected
Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-48706)

Fixed packages 5

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS vim 2:8.1.2269-1ubuntu5.21
Ubuntu · 22.04 LTS 22.04:LTS vim 2:8.2.3995-1ubuntu2.15
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS vim 2:7.4.052-1ubuntu3.1+esm15
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS vim 2:7.4.1689-3ubuntu1.5+esm22
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS vim 2:8.0.1453-1ubuntu1.13+esm7

Vulnerabilities 14

  • High 7.8
    CVE-2022-1897

    Out-of-bounds Write in vim/vim

    Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.

    vim vim/vim vim vim Debian Ubuntu
  • High 7.8
    CVE-2022-2000

    Out-of-bounds Write in vim/vim

    Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.

    vim vim/vim vim vim Debian Ubuntu
  • High 7.4
    CVE-2022-2042

    Use After Free in vim/vim

    Use After Free in GitHub repository vim/vim prior to 8.2.

    vim vim/vim vim vim Debian Ubuntu
  • High 7.1
    CVE-2022-1886

    Heap-based Buffer Overflow in vim/vim

    Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

    vim vim/vim vim vim Debian Ubuntu Azure Linux Alpine
  • Medium 6.6
    CVE-2022-1725

    NULL Pointer Dereference in vim/vim

    NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959.

    vim vim/vim vim vim Debian Ubuntu
  • Medium 5.5
    CVE-2022-1771

    Uncontrolled Recursion in vim/vim

    Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975.

    vim vim/vim vim vim Debian Ubuntu Azure Linux
  • Medium 4.0
    CVE-2023-46246

    Integer Overflow in :history command in Vim

    Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the file `src/alloc.c` at line 748, which is freed in the file `src/ex_docmd.c` in the function `do_cmdline` at line 1010 …

    vim vim vim vim Debian Ubuntu Azure Linux
  • Low 3.9
    CVE-2023-48231

    Use-After-Free in win_close() in vim

    Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be viable. This issue has been addressed in commit `25aabc2b` which…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Low 3.6
    CVE-2023-48706

    Vim has heap-use-after-free at /src/charset.c:1770:12 in skipwhite

    Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Low 2.8
    CVE-2023-48233

    overflow with count for :s command in vim

    Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abort with e_value_too_large. Impact is low, user interaction is required and a crash may not even happen in all situatio…

    vim vim vim vim Debian Ubuntu Azure Linux
  • Low 2.8
    CVE-2023-48234

    overflow in nv_z_get_count in vim

    Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addr…

    vim vim vim vim Debian Ubuntu Azure Linux
  • Low 2.8
    CVE-2023-48235

    overflow in ex address parsing in vim

    Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an overflow. Ironically this happens in the existing overflow check, because the line number becomes negative and LONG_MAX - lnum will cause the o…

    vim vim vim vim Debian Ubuntu Azure Linux
  • Low 2.8
    CVE-2023-48236

    overflow in get_number in vim

    Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAX_INT. Impact is low, user interaction is required and a crash may not even happen in all situations. This vulnerability has b…

    vim vim vim vim Debian Ubuntu Azure Linux
  • Low 2.8
    CVE-2023-48237

    overflow in shift_line in vim

    Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer. Impact is low, user interaction is required and a crash may not…

    vim vim vim vim Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2022-1725
  • report
    https://ubuntu.com/security/CVE-2022-1771
  • report
    https://ubuntu.com/security/CVE-2022-1886
  • report
    https://ubuntu.com/security/CVE-2022-1897
  • report
    https://ubuntu.com/security/CVE-2022-2000
  • report
    https://ubuntu.com/security/CVE-2022-2042
  • report
    https://ubuntu.com/security/CVE-2023-46246
  • report
    https://ubuntu.com/security/CVE-2023-48231
  • report
    https://ubuntu.com/security/CVE-2023-48232
  • report
    https://ubuntu.com/security/CVE-2023-48233
  • report
    https://ubuntu.com/security/CVE-2023-48234
  • report
    https://ubuntu.com/security/CVE-2023-48235
  • report
    https://ubuntu.com/security/CVE-2023-48236
  • report
    https://ubuntu.com/security/CVE-2023-48237
  • report
    https://ubuntu.com/security/CVE-2023-48706