Heap-based Buffer Overflow in vim/vim
Summary
CVE-2023-1170: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376. Affects vim versions < 9.0.1395-r0. Fixed in 9.0.1395-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vim is a highly configurable text editor built for efficiently creating and editing any kind of text. It is widely used by developers and system administrators for its powerful features and extensibility. The vulnerability identified as CVE-2023-1170 affects versions of vim prior to 9.0.1376 in the Alpine Linux distribution (v3.18).
Vulnerability Detail
The vulnerability CVE-2023-1170 is a heap-based buffer overflow in the GitHub repository vim/vim. This vulnerability allows an attacker to overwrite adjacent memory locations, potentially leading to remote code execution or denial of service attacks. The vulnerability was introduced in version 0 of the vim package and was fixed in version 9.0.1395-r0. The CVSS v3 score for this vulnerability is 6.6, indicating a moderate severity.
How To Fix
Minimum fixed version
9.0.1395-r0
This is the first release that contains the fix.
sudo apk add --upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid the vulnerability by refraining from using the affected version of vim or by disabling certain features that may trigger the buffer overflow. However, it is strongly advised to apply the official fix by updating to the patched version.
Conclusion
The heap-based buffer overflow vulnerability in vim/vim prior to version 9.0.1376 poses a moderate risk to users of the Alpine Linux distribution. It is recommended to update the vim package to version 9.0.1395-r0 or later to mitigate the vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vim →
FAQ
The vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial of service by crashing the vim editor.
Yes, this vulnerability affects the vim package in the Alpine Linux distribution version 3.18. Other distributions may have different versions or may not be affected at all.
Yes, this vulnerability can be exploited remotely if an attacker can trick a user into opening a specially crafted file or by exploiting a vulnerable network service.
There are no known instances of this vulnerability being exploited in the wild at the time of this report. However, it is important to apply the fix as soon as possible to mitigate the risk.
For more detailed information about this vulnerability, you can refer to the official CVE-2023-1170 entry at https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1170.json
Related vulnerabilities
Recent vulnerabilities recorded for vim.
