vim up to 9.0.2107 s Command integer overflow

Summaryinfo

A vulnerability was found in vim up to 9.0.2107 and classified as problematic. Impacted is an unknown function of the component s Command Handler. Such manipulation leads to integer overflow. This vulnerability is referenced as CVE-2023-48233. The attack can only be performed from a local environment. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in vim up to 9.0.2107 (Word Processing Software). It has been rated as problematic. Affected by this issue is an unknown code of the component s Command Handler. The manipulation with an unknown input leads to a integer overflow vulnerability. Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. Impacted is availability. CVE summarizes:

Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abort with e_value_too_large. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `ac6378773` which has been included in release version 9.0.2108. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The weakness was published 11/17/2023 as GHSA-3xx4-hcq6-r2vj. The advisory is available at github.com. This vulnerability is handled as CVE-2023-48233 since 11/13/2023. The technical details are unknown and an exploit is not available.

Upgrading to version 9.0.2108 eliminates this vulnerability. Applying the patch ac63787734fda2e294e477af52b3bd601517fa78 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Word Processing Software

Name

• vim

Version

• 9.0.2107

License

• open-source

Website

• Product: https://github.com/vim/vim/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion