CVE-2024-22667

Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.

Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.

Root has patched CVE-2024-22667 in the vim package for Root:Alpine:3.18. Multiple fixed versions available.

Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.

• CVE-2024-22667: addressing a potential stack-buffer-overflow in option processing functions

• CVE-2024-22667: addressing a potential stack-buffer-overflow in option processing functions

• SECURITY UPDATE: stack-buffer-overflow in option callback func
  • debian/patches/CVE-2024-22667.patch: pass size of errbuf down the call stack, use snprintf() instead of sprintf()
  • CVE-2024-22667

• CVE-2023-0054: check the return value of vim_regsub()
• CVE-2023-0049: avoid going over the NUL at the end
• CVE-2023-0288: prevent the cursor from moving to line zero
• CVE-2023-0433: check for not going over the end of the line
• CVE-2023-2610: limit the text length to MAXCOL
• CVE-2023-4750: check buffer is valid before accessing it
• CVE-2023-4733: verify oldwin pointer after reset_VIsual()
• CVE-2023-4751: stop Visual mode when using :ball
• CVE-2023-5344: add NULL at end of buffer
• CVE-2024-22667: pass size of errbuf down the call stack, use snprintf()

• SECURITY UPDATE: stack-based buffer overflow in option callback functions: illegal_char() and did_set_string_option() wrote the E539/E526/E535 option errors into the caller's 80-byte errbuf[] with unbounded sprintf(). The call site reported upstream, did_set_langmap() in src/map.c, does not exist in this version, where 'langmap' errors are reported through EMSG2() into a bounded buffer.
  • debian/patches/CVE-2024-22667.patch: introduce ERR_BUFLEN and use snprintf() bounded by it at the three sprintf() sites, in src/option.c and src/option.h; matches upstream patch 9.0.2142.
  • CVE-2024-22667
• SECURITY UPDATE: buffer overflow in 'helpfile' option handling: get_tagfname() copied the user-controlled 'helpfile' value into a MAXPATHL buffer with STRCPY() and then appended "tags" at the tail, so an over-long 'helpfile' overflowed the buffer.
  • debian/patches/CVE-2026-25749.patch: bound the copy with vim_strncpy() leaving room for the "tags" suffix, in src/tag.c; matches upstream patches 9.1.2132 and 9.1.2133.
  • CVE-2026-25749
• SECURITY UPDATE: buffer overflow in the netbeans specialKeys command: special_keys() walked the modifier prefix writing two bytes per modifier into the 64-byte keybuf[] with no bound, so a long modifier run overflowed it.
  • debian/patches/CVE-2026-26269.patch: stop the modifier loop while i + 2 < KEYBUFLEN, in src/netbeans.c; matches upstream patch 9.1.2148.
  • CVE-2026-26269
• SECURITY UPDATE: command injection via netrw URIs: the hostname and port taken from a netrw URI were interpolated unescaped into the command passed to system(), so shell metacharacters in the host or port ran arbitrary commands.
  • debian/patches/CVE-2026-28417.patch: validate the host against an RFC1123 hostname / IPv4 / IPv6 pattern at the four netrw entry points and shellescape() the host, user and port in s:MakeSshCmd(), in runtime/autoload/netrw.vim; matches upstream patches 9.2.0073, 9.2.0089 and 9.2.0553.
  • CVE-2026-28417
• SECURITY UPDATE: crash and huge allocation recovering a corrupted swap file: ml_recover() trusted pe_page_count, pe_bnum, pe_old_lnum and pe_line_count from the swap file, so bogus values caused a multi-GB mf_get() allocation or a SEGV inside readfile().
  • debian/patches/CVE-2026-28421.patch: bound pe_page_count and pe_bnum against mf_blocknr_max and validate pe_old_lnum and pe_line_count before use, in src/memline.c; matches upstream patch 9.2.0077.
  • CVE-2026-28421
• SECURITY UPDATE: command injection via newline in glob(): the newline character was missing from SHELL_SPECIAL, so it was not escaped before mch_expand_wildcards() handed the pattern to the shell and could act as a command separator.
  • debian/patches/CVE-2026-33412.patch: add '\n' to SHELL_SPECIAL, in src/os_unix.c; matches upstream patch 9.2.0202.
  • CVE-2026-33412
• SECURITY UPDATE: modeline security bypass: several options holding expressions could be set from a modeline, so opening a crafted file evaluated attacker-supplied expressions. In this version the expressions reachable this way are the 'statusline'-style %{} items of 'printheader' and 'guitabtooltip', which were evaluated in the sandbox only; the F{func} flag of 'complete' and the mapset() function named by the upstream advisory arrived in later releases and are not present in this version.
  • debian/patches/patch-8.1.1366-using-expressions-in-a-modeline-is-unsafe.patch: add the 'modelineexpr' option and the P_MLE flag, refuse P_MLE options in a modeline unless 'modelineexpr' is set, mark the expression-bearing options P_MLE, and document 'modelineexpr' and E992, in src/option.c, src/option.h and runtime/doc/options.txt; prerequisite…

The updated packages fix a security vulnerability: Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions. (CVE-2024-22667)

This update for vim fixes the following issues:

• CVE-2023-48231: Fixed Use-After-Free in win_close() (bsc#1217316).
• CVE-2023-48232: Fixed Floating point Exception in adjust_plines_for_skipcol() (bsc#1217320).
• CVE-2023-48233: Fixed overflow with count for :s command (bsc#1217321).
• CVE-2023-48234: Fixed overflow in nv_z_get_count (bsc#1217324).
• CVE-2023-48235: Fixed overflow in ex address parsing (bsc#1217326).
• CVE-2023-48236: Fixed overflow in get_number (bsc#1217329).
• CVE-2023-48237: Fixed overflow in shift_line (bsc#1217330).
• CVE-2023-48706: Fixed heap-use-after-free in ex_substitute (bsc#1217432).
• CVE-2024-22667: Fixed stack-based buffer overflow in did_set_langmap function in map.c (bsc#1219581).
• CVE-2023-4750: Fixed heap use-after-free in function bt_quickfix (bsc#1215005).

Updated to version 9.1 with patch level 0111: https://github.com/vim/vim/compare/v9.0.2103...v9.1.0111

This update for vim fixes the following issues:

• CVE-2023-48231: Fixed Use-After-Free in win_close() (bsc#1217316).
• CVE-2023-48232: Fixed Floating point Exception in adjust_plines_for_skipcol() (bsc#1217320).
• CVE-2023-48233: Fixed overflow with count for :s command (bsc#1217321).
• CVE-2023-48234: Fixed overflow in nv_z_get_count (bsc#1217324).
• CVE-2023-48235: Fixed overflow in ex address parsing (bsc#1217326).
• CVE-2023-48236: Fixed overflow in get_number (bsc#1217329).
• CVE-2023-48237: Fixed overflow in shift_line (bsc#1217330).
• CVE-2023-48706: Fixed heap-use-after-free in ex_substitute (bsc#1217432).
• CVE-2024-22667: Fixed stack-based buffer overflow in did_set_langmap function in map.c (bsc#1219581).
• CVE-2023-4750: Fixed heap use-after-free in function bt_quickfix (bsc#1215005).

Updated to version 9.1 with patch level 0111: https://github.com/vim/vim/compare/v9.0.2103...v9.1.0111

This update for vim fixes the following issues:

Updated to version 9.1.0111, fixes the following security problems

• CVE-2023-48231: Use-After-Free in win_close() (bsc#1217316).
• CVE-2023-48232: Floating point Exception in adjust_plines_for_skipcol() (bsc#1217320).
• CVE-2023-48233: overflow with count for :s command (bsc#1217321).
• CVE-2023-48234: overflow in nv_z_get_count (bsc#1217324).
• CVE-2023-48235: overflow in ex address parsing (CVE-2023-48235).
• CVE-2023-48236: overflow in get_number (bsc#1217329).
• CVE-2023-48237: overflow in shift_line (bsc#1217330).
• CVE-2023-48706: heap-use-after-free in ex_substitute (bsc#1217432).
• CVE-2024-22667: stack-based buffer overflow in did_set_langmap function in map.c (bsc#1219581).
• CVE-2023-4750: Heap use-after-free in function bt_quickfix (bsc#1215005).

Zhen Zhou discovered that Vim did not properly manage memory. An attacker could possibly use this issue to cause a denial of service