Headline
CVE-2023-48234: overflow in nv_z_get_count
Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit 58f9befca1 which has been included in release version 9.0.2109. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected versions
<v9.0.2109
Patched versions
v9.0.2109
Description
overflow in nv_z_get_count
Date: 16.11.2023
Severity: Low
When getting the count for a normal mode z command, it may overflow for large
counts given. So let’s verify that the result can be safely stored, else abort
the z command.
Impact is low, user interaction is required and a crash may not even happen.
The Vim project would like to thank Fabian Toepfer for reporting this issue
which is now fixed in Vim patch 9.0.2109.
Related news
Ubuntu Security Notice 6557-1 - It was discovered that Vim could be made to dereference invalid memory. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. It was discovered that Vim could be made to recurse infinitely. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.