CVE-2023-4751

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331.

• CVE-2023-0054: check the return value of vim_regsub()
• CVE-2023-0049: avoid going over the NUL at the end
• CVE-2023-0288: prevent the cursor from moving to line zero
• CVE-2023-0433: check for not going over the end of the line
• CVE-2023-2610: limit the text length to MAXCOL
• CVE-2023-4750: check buffer is valid before accessing it
• CVE-2023-4733: verify oldwin pointer after reset_VIsual()
• CVE-2023-4751: stop Visual mode when using :ball
• CVE-2023-5344: add NULL at end of buffer
• CVE-2024-22667: pass size of errbuf down the call stack, use snprintf()

• CVE-2023-4751: fix illegal memory access when using :ball
• CVE-2023-4734: fix crash caused by int overflow
• CVE-2023-5344: fix buffer overflow
• CVE-2023-5535: fix use after free

• CVE-2022-4292: also check win_valid_any_tab() in did_set_spelllang() after SpellFileMissing autocmd
• CVE-2023-4751: reset_VIsual_and_resel() at start of ex_buffer_all() to prevent UAF on Visual mark
• CVE-2023-0054: bail out of do_string_sub() when vim_regsub() returns sublen <= 0
• CVE-2022-2206: clamp cmdline_row/msg_row to Rows-1 at end of check_shellsize()
• CVE-2023-5535: block_autocmds()/unblock_autocmds() around buf_contents_changed() temp-buffer life
• CVE-2022-2129: tighten do_exedit() check to (textlock != 0 || curbuf_locked()) instead of curbuf_locked() only

These are all security issues fixed in the gvim-9.0.1894-1.1 package on the GA media of openSUSE Tumbleweed.

It was discovered that Vim could be made to divide by zero. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 23.04. (CVE-2023-3896)

It was discovered that Vim did not properly manage memory. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2023-4733, CVE-2023-4750)

It was discovered that Vim contained an arithmetic overflow. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-4734)

It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2023-4735, CVE-2023-5344)

It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 23.04 and Ubuntu 23.10. (CVE-2023-4738)

It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-4751)

It was discovered that Vim did not properly manage memory. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-4752, CVE-2023-5535)

It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-4781)

It was discovered that Vim could be made to dereference invalid memory. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-5441)