CVE-2023-2610

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531.(CVE-2023-2609)

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.(CVE-2023-2610)

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.

• CVE-2023-2610: limit the text length to MAXCOL

• CVE-2023-2610: limit the text length to MAXCOL

• SECURITY UPDATE: Crash when expanding "~" in substitute causes very long text
  • debian/patches/CVE-2023-2610.patch: Limit the text length to MAXCOL
  • CVE-2023-2610

• CVE-2023-0054: check the return value of vim_regsub()
• CVE-2023-0049: avoid going over the NUL at the end
• CVE-2023-0288: prevent the cursor from moving to line zero
• CVE-2023-0433: check for not going over the end of the line
• CVE-2023-2610: limit the text length to MAXCOL
• CVE-2023-4750: check buffer is valid before accessing it
• CVE-2023-4733: verify oldwin pointer after reset_VIsual()
• CVE-2023-4751: stop Visual mode when using :ball
• CVE-2023-5344: add NULL at end of buffer
• CVE-2024-22667: pass size of errbuf down the call stack, use snprintf()

• CVE-2023-2610: limit the text length to MAXCOL
• CVE-2023-4735: don't overflow buf2, check size in for loop()
• CVE-2023-4750: check buffer is valid before accessing it
• CVE-2023-4752: validate buffer before accessing it
• CVE-2023-4781: disallow exchanging windows when textlock is active
• Drop the patch level in version.c to the original one

This update for vim fixes the following issues:

• CVE-2023-2426: Fixed out-of-range pointer offset (bsc#1210996).
• CVE-2023-2609: Fixed NULL pointer dereference (bsc#1211256).
• CVE-2023-2610: Fixed integer overflow or wraparound (bsc#1211257).

This update for vim fixes the following issues:

Updated to version 9.0 with patch level 1572.

• CVE-2023-2426: Fixed Out-of-range Pointer Offset use (bsc#1210996).
• CVE-2023-2609: Fixed NULL Pointer Dereference (bsc#1211256).
• CVE-2023-2610: Fixed nteger Overflow or Wraparound (bsc#1211257).
• CVE-2023-1264: Fixed NULL Pointer Dereference (bsc#1209042).
• CVE-2023-1355: Fixed NULL Pointer Dereference (bsc#1209187).
• CVE-2023-1127: Fixed divide by zero in scrolldown() (bsc#1208828).

This update for vim fixes the following issues:

Updated to version 9.0 with patch level 1572.

• CVE-2023-2426: Fixed Out-of-range Pointer Offset use (bsc#1210996).
• CVE-2023-2609: Fixed NULL Pointer Dereference (bsc#1211256).
• CVE-2023-2610: Fixed nteger Overflow or Wraparound (bsc#1211257).

It was discovered that Vim was using uninitialized memory when fuzzy matching, which could lead to invalid memory access. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 22.10 and Ubuntu 23.04. (CVE-2023-2426)

It was discovered that Vim was not properly performing bounds checks when processing register contents, which could lead to a NULL pointer dereference. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2023-2609)

It was discovered that Vim was not properly limiting the length of substitution expression strings, which could lead to excessive memory consumption. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-2610)