Critical Integer Overflow Vulnerability in Vim Package
Summary
ALPINE-CVE-2017-6349: An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resulta... Affects vim versions < 8.0.1521-r0. Fixed in 8.0.1521-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is a highly configurable text editor built to enable efficient text editing. It is widely used by developers and system administrators for its powerful features and extensibility. However, Vim versions prior to patch 8.0.1521 are susceptible to a critical integer overflow vulnerability that can lead to severe security risks, including buffer overflows.
Vulnerability Detail
An integer overflow occurs at a memory allocation site in the u_read_undo function when Vim fails to properly validate values for tree length while reading a corrupted undo file. This vulnerability, identified as CVE-2017-6349, can lead to buffer overflows, potentially allowing attackers to execute arbitrary code, crash the application, or compromise system integrity.
How To Fix
Minimum fixed version
8.0.1521-r0
This is the first release that contains the fix.
sudo apk add --upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid opening potentially corrupted undo files until the package is updated. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The integer overflow vulnerability in the Vim package (CVE-2017-6349) poses significant risks to users of affected versions. It is crucial to update to the patched version 8.0.1521-r0 or later to mitigate these risks. Additionally, utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for vim →
FAQ
CVE-2017-6349 is a critical integer overflow vulnerability in the Vim text editor that can lead to buffer overflows and potential code execution.
If you are using a version of Vim prior to 8.0.1521, your installation is vulnerable to CVE-2017-6349.
Exploitation of this vulnerability can lead to arbitrary code execution, application crashes, or system compromise.
Yes, tools like Vulert can monitor your application for open-source vulnerabilities in real-time using a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without requiring an account.
References
Related vulnerabilities
Recent vulnerabilities recorded for vim.
