Use-After-Free Vulnerability in Vim Package - CVE-2024-47814
Summary
ALPINE-CVE-2024-47814: Vim is an open source, command line text editor. Affects vim versions < 9.1.0936-r0. Fixed in 9.1.0936-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is a widely used open-source command line text editor known for its efficiency and versatility in editing text files. It supports various programming languages and offers features like syntax highlighting, multi-level undo, and extensive customization through plugins. However, Vim is susceptible to vulnerabilities that can affect its stability and security, such as the use-after-free issue identified in CVE-2024-47814.
Vulnerability Detail
A use-after-free vulnerability was discovered in Vim versions prior to 9.1.0764. This issue arises when a buffer, visible in a window, is closed while a BufWinLeave auto command is executed. If this command attempts to reopen the same buffer in a new split window, it can lead to a use-after-free condition, potentially causing a crash. Although the impact is considered low since it requires specific user configurations, it poses a risk to application stability.
How To Fix
Minimum fixed version
9.1.0936-r0
This is the first release that contains the fix.
sudo apk add --upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. Users are advised to upgrade to the patched version to mitigate the risk.
Conclusion
The use-after-free vulnerability in Vim (CVE-2024-47814) poses a risk of application crashes under specific conditions. Users are strongly encouraged to upgrade to the patched version to ensure stability and security. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the integrity of your software.
See every vulnerability recorded for vim →
FAQ
CVE-2024-47814 is a use-after-free vulnerability found in the Vim text editor that can lead to application crashes.
The vulnerability can cause Vim to crash when specific auto commands are executed while closing a buffer, leading to instability.
Vim versions prior to 9.1.0764 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 4.7, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for vim.
