Summary
It was discovered that Vim incorrectly handled memory when using invalid
input with the log option. An attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 24.04 LTS and
Ubuntu 24.10. (CVE-2025-1215)
It was discovered that Vim incorrectly handled memory when redirecting
certain output to the register. An attacker could possibly use this issue
to cause a denial of service. (CVE-2025-26603)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | vim | 2:8.1.2269-1ubuntu5.32 |
| Ubuntu · 22.04 LTS 22.04:LTS | vim | 2:8.2.3995-1ubuntu2.24 |
| Ubuntu · 24.04 LTS 24.04:LTS | vim | 2:9.1.0016-1ubuntu7.8 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | vim | 2:7.4.052-1ubuntu3.1+esm21 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | vim | 2:7.4.1689-3ubuntu1.5+esm27 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | vim | 2:8.0.1453-1ubuntu1.13+esm12 |
Vulnerabilities 2
-
Medium 4.2
heap-use-after-free in function str_to_reg in vim/vim
Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex c…
-
Low 2.8
vim main.c memory corruption
A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host…