CVE-2023-4733

Use After Free in GitHub repository vim/vim prior to 9.0.1840.

Use After Free in GitHub repository vim/vim prior to 9.0.1840.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Use After Free in GitHub repository vim/vim prior to 9.0.1840.(CVE-2023-4733)

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846.(CVE-2023-4734)

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847.(CVE-2023-4735)

Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.(CVE-2023-4736)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.(CVE-2023-4738)

Use After Free in GitHub repository vim/vim prior to 9.0.1857.(CVE-2023-4750)

Use After Free in GitHub repository vim/vim prior to 9.0.1858.(CVE-2023-4752)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873.(CVE-2023-4781)

Use After Free in GitHub repository vim/vim prior to 9.0.1840.

• CVE-2023-4733: verify oldwin pointer after reset_VIsual()

• CVE-2023-4733: verify oldwin pointer after reset_VIsual()

• SECURITY UPDATE: Use-after-free in do_ecmd()
  • debian/patches/CVE-2023-4733.patch: Verify oldwin pointer after reset_VIsual()
  • CVE-2023-4733
• SECURITY UPDATE: Potential OOB write in do_addsub()
  • debian/patches/CVE-2023-4735.patch: Don't overflow buf2, check size in for loop()
  • CVE-2023-4735

• CVE-2023-0054: check the return value of vim_regsub()
• CVE-2023-0049: avoid going over the NUL at the end
• CVE-2023-0288: prevent the cursor from moving to line zero
• CVE-2023-0433: check for not going over the end of the line
• CVE-2023-2610: limit the text length to MAXCOL
• CVE-2023-4750: check buffer is valid before accessing it
• CVE-2023-4733: verify oldwin pointer after reset_VIsual()
• CVE-2023-4751: stop Visual mode when using :ball
• CVE-2023-5344: add NULL at end of buffer
• CVE-2024-22667: pass size of errbuf down the call stack, use snprintf()

• CVE-2023-4733: fix use after free vulnerability

Use After Free in GitHub repository vim/vim prior to 9.0.1840. (CVE-2023-4733)

Use After Free in GitHub repository vim/vim prior to 9.0.1857. (CVE-2023-4750)

Use After Free in GitHub repository vim/vim prior to 9.0.1858. (CVE-2023-4752)

This update for vim fixes the following issues:

Security fixes:

• CVE-2023-4733: Fixed use-after-free in function buflist_altfpos (bsc#1215004).
• CVE-2023-4734: Fixed segmentation fault in function f_fullcommand (bsc#1214925).
• CVE-2023-4735: Fixed out of bounds write in ops.c (bsc#1214924).
• CVE-2023-4738: Fixed heap buffer overflow in vim_regsub_both (bsc#1214922).
• CVE-2023-4752: Fixed heap use-after-free in function ins_compl_get_exp (bsc#1215006).
• CVE-2023-4781: Fixed heap buffer overflow in function vim_regsub_both (bsc#1215033).

Other fixes:

• Calling vim on xterm leads to missing first character of the command prompt (bsc#1211461)
• Rendering corruption in gvim with all 9.x versions (bsc#1210738)
• Updated to version 9.0 with patch level 1894

This update for vim fixes the following issues:

Security fixes:

• CVE-2023-4733: Fixed use-after-free in function buflist_altfpos (bsc#1215004).
• CVE-2023-4734: Fixed segmentation fault in function f_fullcommand (bsc#1214925).
• CVE-2023-4735: Fixed out of bounds write in ops.c (bsc#1214924).
• CVE-2023-4738: Fixed heap buffer overflow in vim_regsub_both (bsc#1214922).
• CVE-2023-4752: Fixed heap use-after-free in function ins_compl_get_exp (bsc#1215006).
• CVE-2023-4781: Fixed heap buffer overflow in function vim_regsub_both (bsc#1215033).

Other fixes:

• Update to version 9.0 with patch level 1894, for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1894
• Use app icons generated from vimlogo.eps in the source tarball; add higher resolution icons of sizes 128x128, 256x256, and 512x512 as png sources

This update for vim fixes the following issues:

Updated to version 9.0 with patch level 2103, fixes the following security problems

• CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969 (bsc#1215940)
• CVE-2023-5441: vim: segfault in exmode when redrawing (bsc#1216001)
• CVE-2023-5535: vim: use-after-free from buf_contents_changed() (bsc#1216167)
• CVE-2023-46246: vim: Integer Overflow in :history command (bsc#1216696)
• CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both (bsc#1214922)
• CVE-2023-4735: vim: OOB Write ops.c (bsc#1214924)
• CVE-2023-4734: vim: segmentation fault in function f_fullcommand (bsc#1214925)
• CVE-2023-4733: vim: use-after-free in function buflist_altfpos (bsc#1215004)
• CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp (bsc#1215006)
• CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both (bsc#1215033)

It was discovered that Vim could be made to divide by zero. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 23.04. (CVE-2023-3896)

It was discovered that Vim did not properly manage memory. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2023-4733, CVE-2023-4750)

It was discovered that Vim contained an arithmetic overflow. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-4734)

It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2023-4735, CVE-2023-5344)

It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 23.04 and Ubuntu 23.10. (CVE-2023-4738)

It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-4751)

It was discovered that Vim did not properly manage memory. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-4752, CVE-2023-5535)

It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-4781)

It was discovered that Vim could be made to dereference invalid memory. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-5441)