CVE-2023-4736

Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Use After Free in GitHub repository vim/vim prior to 9.0.1840.(CVE-2023-4733)

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846.(CVE-2023-4734)

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847.(CVE-2023-4735)

Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.(CVE-2023-4736)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.(CVE-2023-4738)

Use After Free in GitHub repository vim/vim prior to 9.0.1857.(CVE-2023-4750)

Use After Free in GitHub repository vim/vim prior to 9.0.1858.(CVE-2023-4752)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873.(CVE-2023-4781)

• CVE-2023-4736: improve search path to avoid run an executable in untrusted dir

• CVE-2023-4736: improve search path to avoid run an executable in untrusted dir

• SECURITY UPDATE: An executable file with some well-known name like zip, gzip, and so on can be started from a current directory during some plugin is opening apropriate file that has a one of the extensions .zip, .gzip, .rb, and etc. This issue is effective only if the PATH environment variable has a ./ (dot) as one element in the path list
  • debian/patches/CVE-2023-4736.patch: avoid starting executable from a current directory for some plugins
  • CVE-2023-4736