CVE-2023-5441

NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960.

NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960.(CVE-2023-5441)

Use After Free in GitHub repository vim/vim prior to v9.0.2010.(CVE-2023-5535)

NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960.

• SECURITY UPDATE: a fix of buffer-overflow in trunc_string()
  • debian/patches/CVE-2023-5344.patch
  • CVE-2023-5344
• SECURITY UPDATE: segfault in exmode
  • debian/patches/CVE-2023-5441.patch
  • CVE-2023-5441

• CVE-2023-5441: segfault in exmode
• CVE-2023-5344: buffer overflow in trunc_string()

• CVE-2023-5441: segfault in exmode
• CVE-2023-5344: buffer overflow in trunc_string()

The updated packages fix security vulnerabilities:

NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960. (CVE-2023-5441)

Use After Free in GitHub repository vim/vim prior to v9.0.2010. (CVE-2023-5535)

This update for vim fixes the following issues:

Updated to version 9.0 with patch level 2103, fixes the following security problems

• CVE-2023-5344: vim: Heap-based Buffer Overflow in vim prior to 9.0.1969 (bsc#1215940)
• CVE-2023-5441: vim: segfault in exmode when redrawing (bsc#1216001)
• CVE-2023-5535: vim: use-after-free from buf_contents_changed() (bsc#1216167)
• CVE-2023-46246: vim: Integer Overflow in :history command (bsc#1216696)
• CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both (bsc#1214922)
• CVE-2023-4735: vim: OOB Write ops.c (bsc#1214924)
• CVE-2023-4734: vim: segmentation fault in function f_fullcommand (bsc#1214925)
• CVE-2023-4733: vim: use-after-free in function buflist_altfpos (bsc#1215004)
• CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp (bsc#1215006)
• CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both (bsc#1215033)

This update for vim fixes the following issues:

• CVE-2023-5344: Heap-based Buffer Overflow in vim prior to 9.0.1969 (bsc#1215940)
• CVE-2023-5441: segfault in exmode when redrawing (bsc#1216001)
• CVE-2023-5535: use-after-free from buf_contents_changed() (bsc#1216167)
• CVE-2023-46246: Integer Overflow in :history command (bsc#1216696)

This update for vim fixes the following issues:

• CVE-2023-5344: Heap-based Buffer Overflow in vim prior to 9.0.1969 (bsc#1215940)
• CVE-2023-5441: segfault in exmode when redrawing (bsc#1216001)
• CVE-2023-5535: use-after-free from buf_contents_changed() (bsc#1216167)
• CVE-2023-46246: Integer Overflow in :history command (bsc#1216696)

It was discovered that Vim could be made to divide by zero. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 23.04. (CVE-2023-3896)

It was discovered that Vim did not properly manage memory. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2023-4733, CVE-2023-4750)

It was discovered that Vim contained an arithmetic overflow. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-4734)

It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2023-4735, CVE-2023-5344)

It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 23.04 and Ubuntu 23.10. (CVE-2023-4738)

It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-4751)

It was discovered that Vim did not properly manage memory. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-4752, CVE-2023-5535)

It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-4781)

It was discovered that Vim could be made to dereference invalid memory. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-5441)