CVE-2024-41957

Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit later, the quickfix list belonging to that window will also be cleared and if that quickfix list points to the same tagstack data, Vim will try to free it again, resulting in a double-free/use-after-free access exception. Impact is low since the user must intentionally execute vim with several non-default flags, but it may cause a crash of Vim. The issue has been fixed as of Vim patch v9.1.0647

Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit later, the quickfix list belonging to that window will also be cleared and if that quickfix list points to the same tagstack data, Vim will try to free it again, resulting in a double-free/use-after-free access exception. Impact is low since the user must intentionally execute vim with several non-default flags, but it may cause a crash of Vim. The issue has been fixed as of Vim patch v9.1.0647

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit later, the quickfix list belonging to that window will also be cleared and if that quickfix list points to the same tagstack data, Vim will try to free it again, resulting in a double-free/use-after-free access exception. Impact is low since the user must intentionally execute vim with several non-default flags, but it may cause a crash of Vim. The issue has been fixed as of Vim patch v9.1.0647(CVE-2024-41957)

Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648.(CVE-2024-41965)

Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit later, the quickfix list belonging to that window will also be cleared and if that quickfix list points to the same tagstack data, Vim will try to free it again, resulting in a double-free/use-after-free access exception. Impact is low since the user must intentionally execute vim with several non-default flags, but it may cause a crash of Vim. The issue has been fixed as of Vim patch v9.1.0647

• CVE-2021-3875: fix ml_get error after search with range; clamp ea->line2 to the buffer length in get_address() so out-of-range addresses do not produce an out-of-bounds read (ex_docmd.c, upstream patch 8.2.3489)
• CVE-2022-4293: fix crash when dividing the largest negative integer by -1 in num_divide(); detect the LONG_MIN / -1 case and clamp the result (typval.c, upstream patch 9.0.0913)
• CVE-2023-48231: fix use-after-free in win_close() when an autocmd closes a previously-validated window; re-check window validity before setting w_closing (window.c, upstream patch 9.0.2106)
• CVE-2023-48235: fix integer overflow in ex address parsing; verify lnum is positive before subtracting from LONG_MAX in get_address() and add e_line_number_out_of_range[] in src/errors.h (ex_docmd.c + errors.h, upstream patches 8.2.3659 + 9.0.2110)
• CVE-2024-41957: fix use-after-free in tagstack_clear_entry(); use VIM_CLEAR to NULL pointers when freeing the tagstack on win_free (window.c, upstream patch 9.1.0647)
• CVE-2024-43374: fix use-after-free in alist_add(); lock the current window across the buflist_add() autocmd window so its tagstack reference cannot be freed underneath us (arglist.c, upstream patch 9.1.0678)
• CVE-2024-47814: fix use-after-free when closing a buffer; abort do_ecmd() if the new buffer is marked for deletion via b_locked or b_locked_split (ex_cmds.c, upstream patch 9.1.0764)

Use-after-free in tagstack_clear_entry() in Vim < v9.1.0647. (CVE-2024-41957) Use-after-free in alist_add() in Vim < v9.1.0678. (CVE-2024-43374)

Root has patched CVE-2024-41957 in the vim package for Root:Alpine:3.19. Multiple fixed versions available.

Root has patched CVE-2024-41957 in the vim package for Root:Debian:12. Multiple fixed versions available.

It was discovered that Vim incorrectly handled memory when closing a window, leading to a double-free vulnerability. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. (CVE-2024-41957)

It was discovered that Vim incorrectly handled memory when adding a new file to an argument list, leading to a use-after-free. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service. (CVE-2024-43374)