High WID-SEC-2023-2249 5 CVEs

vim: Mehrere Schwachstellen

Published Sep 3, 2023 · Updated Mar 30, 2025 · Revision 10 · de-DE

Vendor: amazon Vendor: Debian Vendor: Dell Vendor: SUSE Vendor: Ubuntu Vendor: Xerox Product: ECS Product: FreeFlow Print Server Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: NetWorker Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in vim ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, Dateien zu manipulieren oder beliebigen Code auszuführen.

Product

Vim (Vi IMproved) ist eine Weiterentwicklung des Texteditors vi.

Vulnerabilities 5

High 7.8

CVE-2023-4734

Integer Overflow or Wraparound in vim/vim

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846.

vim vim/vim vim vim Debian Ubuntu Azure Linux Alpine

Sep 2, 2023
High 7.8

CVE-2023-4736

Untrusted Search Path in vim/vim

Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.

vim vim/vim vim vim Azure Linux Alpine

Sep 2, 2023
High 7.8

CVE-2023-4738

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.

vim vim/vim vim vim Debian Azure Linux Alpine

Sep 2, 2023
High 7.8

CVE-2023-4751

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331.

vim vim/vim vim vim Debian Ubuntu

Sep 3, 2023
Medium 4.8

CVE-2023-4735

Out-of-bounds Write in vim/vim

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847.

vim vim/vim vim vim Debian Ubuntu Azure Linux Alpine

Sep 2, 2023

Revision history

2025-03-30 #10
Neue Updates von Debian aufgenommen
2024-07-18 #9
Neue Updates von Dell aufgenommen
2024-03-03 #8
Neue Updates von XEROX aufgenommen
2024-01-28 #7
Neue Updates von Dell aufgenommen
2023-11-26 #6
Neue Updates von SUSE aufgenommen
2023-10-25 #5
Neue Updates von Ubuntu aufgenommen
2023-10-05 #4
Neue Updates von Amazon aufgenommen
2023-10-03 #3
Neue Updates von SUSE aufgenommen
2023-09-25 #2
Neue Updates von Amazon aufgenommen
2023-09-03 #1
Initiale Fassung

References

GitHub Security Advisory GHSA-424w-j4hf-8cgp vom 2023-09-03
https://github.com/advisories/GHSA-424w-j4hf-8cgp
GitHub Security Advisory GHSA-3q9r-pq9x-wfp4 vom 2023-09-03
https://github.com/advisories/GHSA-3q9r-pq9x-wfp4
GitHub Security Advisory GHSA-93j8-r599-v94c vom 2023-09-03
https://github.com/advisories/GHSA-93j8-r599-v94c
GitHub Security Advisory GHSA-x7vr-7frv-2rrh vom 2023-09-03
https://github.com/advisories/GHSA-x7vr-7frv-2rrh
GitHub Security Advisory GHSA-mfhq-77wv-g7gh vom 2023-09-03
https://github.com/advisories/GHSA-mfhq-77wv-g7gh
PoC für CVE-2023-4734
https://huntr.dev/bounties/688e4382-d2b6-439a-a54e-484780f82217/
PoC für CVE-2023-4735
https://huntr.dev/bounties/fc83bde3-f621-42bd-aecb-8c1ae44cba51/
PoC für CVE-2023-4736
https://huntr.dev/bounties/e1ce0995-4df4-4dec-9cd7-3136ac3e8e71/
PoC für CVE-2023-4738
https://huntr.dev/bounties/9fc7dced-a7bb-4479-9718-f956df20f612/
PoC für CVE-2023-4751
https://huntr.dev/bounties/db7be8d6-6cb7-4ae5-9c4e-805423afa378/
GitHub Security Advisory - vim vom 2023-09-03
https://bugzilla.redhat.com/show_bug.cgi?id=2237161
Amazon Linux Security Advisory ALAS-2023-1826 vom 2023-09-26
https://alas.aws.amazon.com/ALAS-2023-1826.html
SUSE Security Update SUSE-SU-2023:3942-1 vom 2023-10-03
https://lists.suse.com/pipermail/sle-security-updates/2023-October/016483.html
SUSE Security Update SUSE-SU-2023:3955-1 vom 2023-10-03
https://lists.suse.com/pipermail/sle-security-updates/2023-October/016486.html
Amazon Linux Security Advisory ALAS2-2023-2266 vom 2023-10-06
https://alas.aws.amazon.com/AL2/ALAS-2023-2266.html
Ubuntu Security Notice USN-6452-1 vom 2023-10-25
https://ubuntu.com/security/notices/USN-6452-1
SUSE Security Update SUSE-SU-2023:4557-1 vom 2023-11-24
https://lists.suse.com/pipermail/sle-security-updates/2023-November/017223.html
DELL Security Update
https://www.dell.com/support/kbdoc/de-de/000221476/dsa-2024-058-security-update-for-dell-networker-vproxy-multiple-components-vulnerabilities
XEROX Security Advisory XRX24-005 vom 2024-03-04
https://security.business.xerox.com/wp-content/uploads/2024/03/Xerox-Security-Bulletin-XRX24-005-Xerox-FreeFlow%C2%AE-Print-Server-v9_Feb-2024.pdf
XEROX Security Advisory XRX24-004 vom 2024-03-04
https://security.business.xerox.com/wp-content/uploads/2024/03/Xerox%C2%AE-Security-Bulletin-XRX24-004-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v7.pdf
Dell Security Advisory DSA-2024-239 vom 2024-07-18
https://www.dell.com/support/kbdoc/de-de/000227051/dsa-2024-239-security-update-dell-ecs-3-8-1-1-for-multiple-security-vulnerabilities
Debian Security Advisory DLA-4097 vom 2025-03-30
https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html