vim up to 9.0.2108 Normal Mode integer overflow

Summaryinfo

A vulnerability was found in vim up to 9.0.2108. It has been classified as problematic. The affected element is an unknown function of the component Normal Mode. Performing a manipulation results in integer overflow. This vulnerability is identified as CVE-2023-48234. The attack is only possible with local access. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in vim up to 9.0.2108 (Word Processing Software). This affects an unknown code block of the component Normal Mode. The manipulation with an unknown input leads to a integer overflow vulnerability. CWE is classifying the issue as CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. This is going to have an impact on availability. The summary by CVE is:

Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `58f9befca1` which has been included in release version 9.0.2109. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The weakness was released 11/17/2023 as GHSA-59gw-c949-6phq. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2023-48234 since 11/13/2023. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 9.0.2109 eliminates this vulnerability. Applying the patch 58f9befca1fa172068effad7f2ea5a9d6a7b0cca is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Word Processing Software

Name

• vim

Version

• 9.0.2108

License

• open-source

Website

• Product: https://github.com/vim/vim/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion