CVE-2023-1175

Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.

Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.(CVE-2023-1170)

Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.(CVE-2023-1175)

Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.

• SECURITY UPDATE: Illegal memory access when using virtual editing
  • debian/patches/CVE-2023-1175: Make sure "startspaces" is not negative
  • CVE-2023-1175

• CVE-2023-1175: make sure "startspaces" is not negative

• CVE-2023-1175: make sure "startspaces" is not negative

• CVE-2023-1170: at the end of do_put() (ops.c), clamp the cursor column back to the line length (and recompute coladd under virtualedit=all) so a Visual block put past the new NUL no longer leaves the cursor pointing past end-of-line.
• CVE-2023-1175: in op_yank() (ops.c), when the yank starts inside a multi-cell tab under virtual editing, clamp bd.startspaces to 0 before incrementing startcol so a negative width can't drive the later block-yank copy out of bounds.
• CVE-2023-1264: in vgetorpeek() (getchar.c), guard the dead-character putcmdline()/unputcmdline() paths with cmdline_has_buffer() (new ex_getln.c helper) so a nested :open command with a NULL ccline.cmdbuff no longer dereferences it.

Divide By Zero in GitHub repository vim/vim prior to 9.0.1367. (CVE-2023-1127) Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376. (CVE-2023-1170) Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378. (CVE-2023-1175)

These are all security issues fixed in the gvim-9.0.1392-1.1 package on the GA media of openSUSE Tumbleweed.

This update for vim fixes the following issues:

• CVE-2023-0512: Fixed a divide By Zero (bsc#1207780).
• CVE-2023-1175: vim: an incorrect calculation of buffer size (bsc#1208957).
• CVE-2023-1170: Fixed a heap-based Buffer Overflow (bsc#1208959).
• CVE-2023-1127: Fixed divide by zero in scrolldown() (bsc#1208828).

Updated to version 9.0 with patch level 1386.

• https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386

This update for vim fixes the following issues:

• CVE-2023-0512: Fixed a divide By Zero (bsc#1207780).
• CVE-2023-1175: vim: an incorrect calculation of buffer size (bsc#1208957).
• CVE-2023-1170: Fixed a heap-based Buffer Overflow (bsc#1208959).
• CVE-2023-1127: Fixed divide by zero in scrolldown() (bsc#1208828).

Updated to version 9.0 with patch level 1386.

• https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386

This update for vim fixes the following issues:

• CVE-2023-0512: Fixed a divide By Zero (bsc#1207780).
• CVE-2023-1175: vim: an incorrect calculation of buffer size (bsc#1208957).
• CVE-2023-1170: Fixed a heap-based Buffer Overflow (bsc#1208959).
• CVE-2023-1127: Fixed divide by zero in scrolldown() (bsc#1208828).

Updated to version 9.0 with patch level 1386.

• https://github.com/vim/vim/compare/v9.0.1234...v9.0.1386

It was discovered that Vim was not properly performing memory management operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-47024, CVE-2023-0049, CVE-2023-0054, CVE-2023-0288, CVE-2023-0433)

It was discovered that Vim was not properly performing memory management
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2023-0051)

It was discovered that Vim was not properly performing memory management
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. (CVE-2023-1170, CVE-2023-1175)

It was discovered that Vim was not properly performing memory management
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2023-1264)