CVE-2024-43374

The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers Buf* autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying. Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free. Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers Buf* autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying. Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free. Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678.(CVE-2024-43374)

Root has patched CVE-2024-43374 in the vim package for Root:Alpine:3.18. Multiple fixed versions available.

Root has patched CVE-2024-43374 in the vim package for Root:Alpine:3.19. Multiple fixed versions available.

The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers Buf* autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying. Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free. Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678.

The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers Buf* autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying. Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free. Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678.

The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers Buf* autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying. Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free. Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678.

• SECURITY UPDATE: use-after-free in alist_add()
  • debian/patches/CVE-2024-43374.patch: lock the current window so that the reference to the argument list remains valid
  • CVE-2024-43374

• CVE-2021-3875: fix ml_get error after search with range; clamp ea->line2 to the buffer length in get_address() so out-of-range addresses do not produce an out-of-bounds read (ex_docmd.c, upstream patch 8.2.3489)
• CVE-2022-4293: fix crash when dividing the largest negative integer by -1 in num_divide(); detect the LONG_MIN / -1 case and clamp the result (typval.c, upstream patch 9.0.0913)
• CVE-2023-48231: fix use-after-free in win_close() when an autocmd closes a previously-validated window; re-check window validity before setting w_closing (window.c, upstream patch 9.0.2106)
• CVE-2023-48235: fix integer overflow in ex address parsing; verify lnum is positive before subtracting from LONG_MAX in get_address() and add e_line_number_out_of_range[] in src/errors.h (ex_docmd.c + errors.h, upstream patches 8.2.3659 + 9.0.2110)
• CVE-2024-41957: fix use-after-free in tagstack_clear_entry(); use VIM_CLEAR to NULL pointers when freeing the tagstack on win_free (window.c, upstream patch 9.1.0647)
• CVE-2024-43374: fix use-after-free in alist_add(); lock the current window across the buflist_add() autocmd window so its tagstack reference cannot be freed underneath us (arglist.c, upstream patch 9.1.0678)
• CVE-2024-47814: fix use-after-free when closing a buffer; abort do_ecmd() if the new buffer is marked for deletion via b_locked or b_locked_split (ex_cmds.c, upstream patch 9.1.0764)

Use-after-free in tagstack_clear_entry() in Vim < v9.1.0647. (CVE-2024-41957) Use-after-free in alist_add() in Vim < v9.1.0678. (CVE-2024-43374)

This update for vim fixes the following issues:

• CVE-2024-47814: Fixed use-after-free when closing buffers in Vim (bsc#1231373)
• CVE-2024-43374: Fixed use-after-free in alist_add() (bsc#1229238)

Other fixes:

• Updated to version 9.1.0836

This update for vim fixes the following issues:

• CVE-2024-47814: Fixed use-after-free when closing buffers in Vim (bsc#1231373)
• CVE-2024-43374: Fixed use-after-free in alist_add() (bsc#1229238)

Other fixes:

• Remove patch that introduced a bug caused significantly more CPU usage (bsc#1220618)
• Updated to version 9.1.0836

This update for vim fixes the following issues:

vim was updated to 9.1.1101:

• CVE-2024-43374: Fixed use-after-free in alist_add() (bsc#1229238)
• CVE-2024-43790: Fixed Out of bounds read when performing a search command (bsc#1229685)
• CVE-2024-43802: Fixed heap-buffer-overflow in ins_typebuf() (bsc#1229822)
• CVE-2024-45306: Fixed heap-buffer-overflow in Vim (bsc#1230078)
• CVE-2024-47814: Fixed use-after-free when closing buffers in Vim (bsc#1231373)
• CVE-2025-1215: Fixed manipulation of the argument --log leads to memory corruption (bsc#1237137)
• CVE-2025-22134: Fixed heap-buffer-overflow in Vim < 9.1.1003 (bsc#1235695)
• CVE-2025-24014: Fixed segmentation fault in win_line() in Vim < 9.1.1043 (bsc#1236151)

Update to 9.1.1101:

• insexpand.c hard to read
• tests: Test_log_nonexistent only works on Linux
• Update base-syntax, improve variable matching
• Vim9: import with extends may crash
• leaking memory with completing multi lines
• --log with non-existent path causes a crash
• if_perl: Perl 5.38 adds new symbols causing link failure
• tests: matchparen plugin test wrongly named
• Vim9: problem finding implemented method in type hierarchy
• runtime(qf): Update syntax file, match second delimiter
• tests: output of test ...win32_ctrl_z depends on python version
• tests: fix expected return code for python 3.13 on Windows
• tests: timeout might be a bit too small
• tests: test_terminwscroll_topline2 unreliable
• tests: No check when tests are run under Github actions
• tests: plugin tests are named inconsistently
• Vim9: import with extends may crash
• completion doesn't work with multi lines
• filetype: cmmt files are not recognized
• Unable to persistently ignore events in a window and its buffers
• improve syntax highlighting
• setreg() doesn't correctly handle mbyte chars in blockwise mode
• unexpected DCS responses may cause out of bounds reads
• has('bsd') is true for GNU/Hurd
• filetype: Mill files are not recognized
• GUI late startup leads to uninitialized scrollbars
• Add support for lz4 to tar & gzip plugin
• Terminal ansi colors off by one after tgc reset
• included syntax items do not understand contains=TOP
• vim_strnchr() is strange and unnecessary
• Vim9: len variable not used in compile_load()
• runtime(vim): Update base-syntax, match :debuggreedy count prefix
• Strange error when heredoc marker starts with "trim"
• tests: test_compiler fails on Windows without Maven
• 'diffopt' "linematch" cannot be used with {n} less than 10
• args missing after failing to redefine a function
• Cannot control cursor positioning of getchar()
• preinsert text completions not deleted with <C-W>/<C-U>
• getchar() can't distinguish between C-I and Tab
• tests: Test_termwinscroll_topline2 fails on MacOS
• heap-use-after-free and stack-use-after-scope with :14verbose
• no digraph for "Approaches the limit"
• not possible to use plural forms with gettext()
• too many strlen() calls in userfunc.c
• terminal: E315 when dragging the terminal with the mouse
• runtime(openPlugin): fix unclosed parenthesis in GetWordUnderCursor()
• runtime(doc): Tweak documentation style a bit
• tests: test_glvs fails when unarchiver not available
• Vim always enables 'termguicolors' in a terminal
• completion: input text deleted with preinsert when adding leader
• translation(sr): Missing Serbian translation for the tutor
• Superfluous cleanup steps in test_ins_complete.vim
• runtime(netrw): correct wrong version check
• Vim doesn't highlight to be inserted text when completing
• runtime(netrw): upstream snapshot of v176
• runtime(dist/vim9): fix regressions in dist#vim9#Open
• runtime(hyprlang): fix string recognition
• make install fails because of a missing dependency
• runtime(asm): add byte directives to syntax script
• Vim doesn't work well with TERM=xterm-direct
• runtime(filetype): commit 99181205c5f8284a3 breaks V…

It was discovered that Vim incorrectly handled memory when closing a window, leading to a double-free vulnerability. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. (CVE-2024-41957)

It was discovered that Vim incorrectly handled memory when adding a new file to an argument list, leading to a use-after-free. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service. (CVE-2024-43374)