CVE-2023-46246

Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function ga_grow_inner in in the file src/alloc.c at line 748, which is freed in the file src/ex_docmd.c in the function do_cmdline at line 1010 and then used again in src/cmdhist.c at line 759. When using the :history command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function ga_grow_inner in in the file src/alloc.c at line 748, which is freed in the file src/ex_docmd.c in the function do_cmdline at line 1010 and then used again in src/cmdhist.c at line 759. When using the :history command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068. (CVE-2023-46246)

Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function ga_grow_inner in in the file src/alloc.c at line 748, which is freed in the file src/ex_docmd.c in the function do_cmdline at line 1010 and then used again in src/cmdhist.c at line 759. When using the :history command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068.

• SECURITY UPDATE: use-after-free in win_close()
  • debian/patches/CVE-2023-48231.patch: check window is valid, before accessing it
  • CVE-2023-48231
• SECURITY UPDATE: overflow with count for :s command
  • debian/patches/CVE-2023-48233.patch: abort the :s command if the count is too large
  • CVE-2023-48233
• SECURITY UPDATE: overflow in nv_z_get_count
  • debian/patches/CVE-2023-48234.patch: break out, if count is too large
  • CVE-2023-48234
• SECURITY UPDATE: overflow in ex address parsing
  • debian/patches/CVE-2023-48235.patch: verify that lnum is positive, before substracting from LONG_MAX
  • CVE-2023-48235
• SECURITY UPDATE: overflow in get_number
  • debian/patches/CVE-2023-48236.patch: return 0 when the count gets too large
  • CVE-2023-48236
• SECURITY UPDATE: overflow in shift_line
  • debian/patches/CVE-2023-48237.patch: allow a max indent of INT_MAX
  • CVE-2023-48237
• SECURITY UPDATE: overflow in :history
  • debian/patches/CVE-2023-46246.patch: check that value fits into int
  • CVE-2023-46246
• SECURITY UPDATE: recursive command line loop may cause a crash
  • debian/patches/CVE-2022-1771.patch: limit recursion of getcmdline()
  • CVE-2022-1771

• CVE-2021-3796: fix use-after-free in nv_replace by getting the line pointer again after ins_copychar may have released it
• CVE-2021-3973: fix heap buffer overflow in find_file_in_path_option by rejecting len == 0 inputs
• CVE-2022-0413: fix use-after-free in do_sub when the substitute string is a "=" expression by copying the string before eval
• CVE-2022-0943: fix heap overflow in spell_suggest when "z=" in Visual mode by clamping badlen to the remaining line length
• CVE-2022-1620: fix NULL pointer access by guarding both vim_regexec calls in fname_match and the second fname_match call in buflist_match against rmp->regprog becoming NULL after the AUTOMATIC_ENGINE fallback fails to recompile the pattern
• CVE-2022-1796: fix use-after-free in find_pattern_in_path by making a copy of the identifier pointer before the call
• CVE-2022-2207: fix read-before-start-of-line in ins_bs by requiring w_cursor.col > 0 in the whitespace back-step loop
• CVE-2022-3235: fix use-after-free in cmdline input-method handling by tracking the owning buffer and checking buf_valid
• CVE-2022-3296: fix buffer underflow in ex_finally by searching for a valid CSF_TRY frame before accessing cs_flags
• CVE-2023-46246: fix integer overflow in :history by clamping long values to INT_MAX before casting to int
• CVE-2023-48231: fix use-after-free in win_close by returning early when the window is no longer valid after BufLeave
• CVE-2023-48706: fix use-after-free in ex_substitute by always allocating sub and freeing it on every exit path
• CVE-2026-33412: fix command injection via newline in glob() by adding '\n' to the SHELL_SPECIAL escape set

The updated packages fix a security vulnerability:

Integer overflow in :history Ex-Command in Vim < 9.0.2068.

This update for vim fixes the following issues:

Updated to version 9.0 with patch level 2103, fixes the following security problems

• CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969 (bsc#1215940)
• CVE-2023-5441: vim: segfault in exmode when redrawing (bsc#1216001)
• CVE-2023-5535: vim: use-after-free from buf_contents_changed() (bsc#1216167)
• CVE-2023-46246: vim: Integer Overflow in :history command (bsc#1216696)
• CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both (bsc#1214922)
• CVE-2023-4735: vim: OOB Write ops.c (bsc#1214924)
• CVE-2023-4734: vim: segmentation fault in function f_fullcommand (bsc#1214925)
• CVE-2023-4733: vim: use-after-free in function buflist_altfpos (bsc#1215004)
• CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp (bsc#1215006)
• CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both (bsc#1215033)

This update for vim fixes the following issues:

• CVE-2023-5344: Heap-based Buffer Overflow in vim prior to 9.0.1969 (bsc#1215940)
• CVE-2023-5441: segfault in exmode when redrawing (bsc#1216001)
• CVE-2023-5535: use-after-free from buf_contents_changed() (bsc#1216167)
• CVE-2023-46246: Integer Overflow in :history command (bsc#1216696)

This update for vim fixes the following issues:

• CVE-2023-5344: Heap-based Buffer Overflow in vim prior to 9.0.1969 (bsc#1215940)
• CVE-2023-5441: segfault in exmode when redrawing (bsc#1216001)
• CVE-2023-5535: use-after-free from buf_contents_changed() (bsc#1216167)
• CVE-2023-46246: Integer Overflow in :history command (bsc#1216696)

It was discovered that Vim could be made to dereference invalid memory. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1725)

It was discovered that Vim could be made to recurse infinitely. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1771)

It was discovered that Vim could be made to write out of bounds with a put command. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-1886)

It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1897, CVE-2022-2000)

It was discovered that Vim did not properly manage memory in the spell command. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-2042)

It was discovered that Vim did not properly manage memory. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2023-46246, CVE-2023-48231)

It was discovered that Vim could be made to divide by zero. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 23.04 and Ubuntu 23.10. (CVE-2023-48232)

It was discovered that Vim contained multiple arithmetic overflows. An attacker could possibly use these issues to cause a denial of service. (CVE-2023-48233, CVE-2023-48234, CVE-2023-48235, CVE-2023-48236, CVE-2023-48237)

It was discovered that Vim did not properly manage memory in the substitute command. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-48706)