CVE-2023-2609

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531.

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531.(CVE-2023-2609)

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.(CVE-2023-2610)

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531.

• CVE-2023-2609: check "y_array" is not NULL

• CVE-2023-2609: check "y_array" is not NULL

• SECURITY UPDATE: NULL pointer dereference in get_register()
  • debian/patches/CVE-2023-2609.patch: Check "y_array" is not NULL
  • CVE-2023-2609

• CVE-2022-2182: in do_one_cmd(), after ";" sets curwin->w_cursor.lnum to ea.line2, call check_cursor() instead of check_cursor_lnum() so the column is validated too, and fall back to check_cursor_col() when ea.line2 is zero, preventing read past end-of-line on ":0;'{".
• CVE-2022-2206: in check_shellsize(), clamp cmdline_row and msg_row to Rows - 1 after limit_screen_size() so a shrinking terminal cannot leave those values referencing freed screen rows.
• CVE-2022-2257: in str2special(), when the byte is single-byte set *sp = str + (*str == NUL ? 0 : 1) so the caller cannot walk past the terminating NUL when a menu item ends in a modifier-only key.
• CVE-2022-2849: in latin_ptr2len()/dbcs_ptr2len(), return 0 when *p == NUL so loops that advance by mb_ptr2len() cannot walk past the NUL terminator (matches the contract documented in src/globals.h).
• CVE-2022-3352: in spell_load_lang(), snapshot curbuf before the SpellFileMissing autocommand and break out of the retry loop if the autocommand deleted/replaced curbuf, preventing a use-after-free on the cached "lang"/"curbuf" pointer. Uses sl.sl_lang (stack copy) for the apply_autocmds pattern to survive buffer deletion.
• CVE-2023-2609: in get_register() (ops.c), treat y_current->y_array == NULL the same as y_size == 0 and set reg->y_array to NULL, so an invalid/NULL register contents cannot be walked as a valid string vector.
• CVE-2021-3778: in find_match_text() (regexp_nfa.c), advance by utf_ptr2len(regline + col + len2) under enc_utf8 instead of MB_CHAR2LEN(c2), so an invalid UTF-8 byte cannot cause a read past the end of the line.
• CVE-2022-1616: in append_command() (ex_docmd.c), change the buffer-space check to "d - IObuff + 5 < IOSIZE" and skip copying a multibyte character whose length would overrun IObuff, so an invalid command with composing chars cannot overflow the error- message buffer.
• CVE-2022-1897: in undo_time() (undo.c), call text_locked() / text_locked_msg() and return early, so :undo / :earlier / g- cannot run while the text is locked (e.g. inside a :substitute callback) and free a buffer the caller is still walking.
• CVE-2022-2125: in get_lisp_indent() (misc1.c), after the double-quoted-string skip loop break out of the outer scan loop when *that is NUL so lisp indenting cannot walk past end-of-line on an unterminated quote.

• CVE-2022-2182: in do_one_cmd(), after ";" sets curwin->w_cursor.lnum to ea.line2, call check_cursor() instead of check_cursor_lnum() so the column is validated too, and fall back to check_cursor_col() when ea.line2 is zero, preventing read past end-of-line on ":0;'{".
• CVE-2022-2206: in check_shellsize(), clamp cmdline_row and msg_row to Rows - 1 after limit_screen_size() so a shrinking terminal cannot leave those values referencing freed screen rows.
• CVE-2022-2257: in str2special(), when the byte is single-byte set *sp = str + (*str == NUL ? 0 : 1) so the caller cannot walk past the terminating NUL when a menu item ends in a modifier-only key.
• CVE-2022-2849: in latin_ptr2len()/dbcs_ptr2len(), return 0 when *p == NUL so loops that advance by mb_ptr2len() cannot walk past the NUL terminator (matches the contract documented in src/globals.h).
• CVE-2022-3352: in spell_load_lang(), snapshot curbuf before the SpellFileMissing autocommand and break out of the retry loop if the autocommand deleted/replaced curbuf, preventing a use-after-free on the cached "lang"/"curbuf" pointer. Uses sl.sl_lang (stack copy) for the apply_autocmds pattern to survive buffer deletion.
• CVE-2023-2609: in get_register() (ops.c), treat y_current->y_array == NULL the same as y_size == 0 and set reg->y_array to NULL, so an invalid/NULL register contents cannot be walked as a valid string vector.
• CVE-2021-3778: in find_match_text() (regexp_nfa.c), advance by utf_ptr2len(regline + col + len2) under enc_utf8 instead of MB_CHAR2LEN(c2), so an invalid UTF-8 byte cannot cause a read past the end of the line.
• CVE-2022-1616: in append_command() (ex_docmd.c), change the buffer-space check to "d - IObuff + 5 < IOSIZE" and skip copying a multibyte character whose length would overrun IObuff, so an invalid command with composing chars cannot overflow the error- message buffer.
• CVE-2022-1897: in undo_time() (undo.c), call text_locked() / text_locked_msg() and return early, so :undo / :earlier / g- cannot run while the text is locked (e.g. inside a :substitute callback) and free a buffer the caller is still walking.
• CVE-2022-2125: in get_lisp_indent() (misc1.c), after the double-quoted-string skip loop break out of the outer scan loop when *that is NUL so lisp indenting cannot walk past end-of-line on an unterminated quote.

These are all security issues fixed in the gvim-9.0.1538-1.1 package on the GA media of openSUSE Tumbleweed.

This update for vim fixes the following issues:

• CVE-2023-2426: Fixed out-of-range pointer offset (bsc#1210996).
• CVE-2023-2609: Fixed NULL pointer dereference (bsc#1211256).
• CVE-2023-2610: Fixed integer overflow or wraparound (bsc#1211257).

This update for vim fixes the following issues:

Updated to version 9.0 with patch level 1572.

• CVE-2023-2426: Fixed Out-of-range Pointer Offset use (bsc#1210996).
• CVE-2023-2609: Fixed NULL Pointer Dereference (bsc#1211256).
• CVE-2023-2610: Fixed nteger Overflow or Wraparound (bsc#1211257).
• CVE-2023-1264: Fixed NULL Pointer Dereference (bsc#1209042).
• CVE-2023-1355: Fixed NULL Pointer Dereference (bsc#1209187).
• CVE-2023-1127: Fixed divide by zero in scrolldown() (bsc#1208828).

This update for vim fixes the following issues:

Updated to version 9.0 with patch level 1572.

• CVE-2023-2426: Fixed Out-of-range Pointer Offset use (bsc#1210996).
• CVE-2023-2609: Fixed NULL Pointer Dereference (bsc#1211256).
• CVE-2023-2610: Fixed nteger Overflow or Wraparound (bsc#1211257).

It was discovered that Vim was using uninitialized memory when fuzzy matching, which could lead to invalid memory access. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 22.10 and Ubuntu 23.04. (CVE-2023-2426)

It was discovered that Vim was not properly performing bounds checks when processing register contents, which could lead to a NULL pointer dereference. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2023-2609)

It was discovered that Vim was not properly limiting the length of substitution expression strings, which could lead to excessive memory consumption. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-2610)