CVE-2023-4781

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Use After Free in GitHub repository vim/vim prior to 9.0.1840.(CVE-2023-4733)

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846.(CVE-2023-4734)

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847.(CVE-2023-4735)

Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.(CVE-2023-4736)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.(CVE-2023-4738)

Use After Free in GitHub repository vim/vim prior to 9.0.1857.(CVE-2023-4750)

Use After Free in GitHub repository vim/vim prior to 9.0.1858.(CVE-2023-4752)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873.(CVE-2023-4781)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873.

• CVE-2023-2610: limit the text length to MAXCOL
• CVE-2023-4735: don't overflow buf2, check size in for loop()
• CVE-2023-4750: check buffer is valid before accessing it
• CVE-2023-4752: validate buffer before accessing it
• CVE-2023-4781: disallow exchanging windows when textlock is active
• Drop the patch level in version.c to the original one

• Fix CVE-2023-4781.patch
  • debian/patches/CVE-2023-4781.patch: patch win_exchange() instead of win_rotate()

• CVE-2022-0572: heap overflow on vcol-overflow in :retab (upstream vim 8.2.4359)
• CVE-2022-0368: illegal memory access when undo makes Visual area invalid (upstream vim 8.2.4217)
• CVE-2022-0685: crash on multi-byte char in unix_expandpath() (upstream vim 8.2.4418)
• CVE-2022-2125: heap overflow in get_lisp_indent() (upstream vim 8.2.5122)
• CVE-2022-2183: reading past end-of-line in lisp indenting (upstream vim 8.2.5151)
• CVE-2022-2124: reading past end-of-line in current_quote() (upstream vim 8.2.5120)
• CVE-2022-2344: heap overflow in ins_compl_add() (upstream vim 9.0.0046)
• CVE-2022-3256: use-after-free in movemark() when autocmd changes mark (upstream vim 9.0.0530)
• CVE-2023-4752: heap use-after-free in ins_compl_get_exp() (upstream vim 9.0.1858)
• CVE-2022-2126: spell-suggest read past bad word (upstream vim 8.2.5123)
• CVE-2022-2946: use-after-free in do_tag() when tagfunc invalidates tagstack (upstream vim 9.0.0246)
• CVE-2022-1720: OOB read in get_visual_text() (upstream vim 8.2.4956)
• CVE-2022-3234: OOB write in op_replace() (upstream vim 9.0.0483)
• CVE-2023-0433: same_leader() read past end-of-line on short comment line (upstream vim 9.0.1225)
• CVE-2023-4781: heap-buffer-overflow in vim_regsub_both() via nmatch underflow in :substitute, plus textlock guard in win_exchange() (upstream vim 9.0.1873)
• CVE-2022-0351: crash on deeply nested expression (upstream vim 8.2.4206)
• CVE-2022-2175: new_cmdpos leak across register insertion in getcmdline() (upstream vim 8.2.5148)
• CVE-2026-39881: netbeans command injection via crafted sign/highlight identifier + special-keys (upstream vim 9.2.0316)
• CVE-2021-4166: heap-buffer-overflow when clearing the argument list while it is being used (upstream vim 8.2.3884, with 8.2.2421 + 8.2.2463 prereqs for arglist_locked plumbing)
• CVE-2022-2343: heap-buffer-overflow in ins_compl_add_infercase() on long line with 'infercase' (upstream vim 9.0.0045)
• CVE-2022-3296: stack underflow in ex_finally / ex_endtry when :finally lacks an enclosing :try (upstream vim 9.0.0577)

This update for vim fixes the following issues:

Security fixes:

• CVE-2023-4733: Fixed use-after-free in function buflist_altfpos (bsc#1215004).
• CVE-2023-4734: Fixed segmentation fault in function f_fullcommand (bsc#1214925).
• CVE-2023-4735: Fixed out of bounds write in ops.c (bsc#1214924).
• CVE-2023-4738: Fixed heap buffer overflow in vim_regsub_both (bsc#1214922).
• CVE-2023-4752: Fixed heap use-after-free in function ins_compl_get_exp (bsc#1215006).
• CVE-2023-4781: Fixed heap buffer overflow in function vim_regsub_both (bsc#1215033).

Other fixes:

• Calling vim on xterm leads to missing first character of the command prompt (bsc#1211461)
• Rendering corruption in gvim with all 9.x versions (bsc#1210738)
• Updated to version 9.0 with patch level 1894

This update for vim fixes the following issues:

Security fixes:

• CVE-2023-4733: Fixed use-after-free in function buflist_altfpos (bsc#1215004).
• CVE-2023-4734: Fixed segmentation fault in function f_fullcommand (bsc#1214925).
• CVE-2023-4735: Fixed out of bounds write in ops.c (bsc#1214924).
• CVE-2023-4738: Fixed heap buffer overflow in vim_regsub_both (bsc#1214922).
• CVE-2023-4752: Fixed heap use-after-free in function ins_compl_get_exp (bsc#1215006).
• CVE-2023-4781: Fixed heap buffer overflow in function vim_regsub_both (bsc#1215033).

Other fixes:

• Update to version 9.0 with patch level 1894, for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1894
• Use app icons generated from vimlogo.eps in the source tarball; add higher resolution icons of sizes 128x128, 256x256, and 512x512 as png sources

This update for vim fixes the following issues:

Updated to version 9.0 with patch level 2103, fixes the following security problems

• CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969 (bsc#1215940)
• CVE-2023-5441: vim: segfault in exmode when redrawing (bsc#1216001)
• CVE-2023-5535: vim: use-after-free from buf_contents_changed() (bsc#1216167)
• CVE-2023-46246: vim: Integer Overflow in :history command (bsc#1216696)
• CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both (bsc#1214922)
• CVE-2023-4735: vim: OOB Write ops.c (bsc#1214924)
• CVE-2023-4734: vim: segmentation fault in function f_fullcommand (bsc#1214925)
• CVE-2023-4733: vim: use-after-free in function buflist_altfpos (bsc#1215004)
• CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp (bsc#1215006)
• CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both (bsc#1215033)

It was discovered that Vim could be made to divide by zero. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 23.04. (CVE-2023-3896)

It was discovered that Vim did not properly manage memory. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2023-4733, CVE-2023-4750)

It was discovered that Vim contained an arithmetic overflow. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-4734)

It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2023-4735, CVE-2023-5344)

It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 23.04 and Ubuntu 23.10. (CVE-2023-4738)

It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-4751)

It was discovered that Vim did not properly manage memory. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-4752, CVE-2023-5535)

It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-4781)

It was discovered that Vim could be made to dereference invalid memory. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-5441)