Vulnerability in Vim: Overflow Risk in Relative Ex Addresses
Summary
DEBIAN-CVE-2023-48235: Vim is an open source command line text editor. Affects vim versions < 2:9.0.2116-1. Fixed in 2:9.0.2116-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Vim is a widely used open source command line text editor known for its efficiency and versatility in editing text files. It supports various programming languages and is favored by developers for its powerful features, including syntax highlighting, multi-file editing, and extensive plugin support. However, Vim has been identified to have a vulnerability that affects its ability to handle certain relative ex addresses, potentially leading to crashes under specific conditions.
Vulnerability Detail
The vulnerability arises from an overflow issue when Vim parses relative ex addresses. This occurs due to an existing overflow check that can lead to a negative line number, causing the calculation LONG_MAX - lnum to overflow. The impact of this vulnerability is considered low, as it requires user interaction to trigger and may not always result in a crash. The issue has been documented in commit 060623e and affects versions prior to 2:9.0.2116-1.
How To Fix
Minimum fixed version
2:9.0.2116-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are currently no known workarounds for this vulnerability aside from upgrading to the patched version.
Conclusion
In summary, the identified vulnerability in Vim poses a low risk but requires user action to exploit. Users are strongly encouraged to upgrade to the latest version to ensure their systems remain secure. Regular monitoring for vulnerabilities can be facilitated using tools like Vulert, which provides real-time alerts for open-source vulnerabilities without requiring code access.
See every vulnerability recorded for vim →
FAQ
The vulnerability is an overflow issue that occurs when parsing relative ex addresses, potentially leading to crashes.
If you are using a version prior to 2:9.0.2116-1, your installation is vulnerable.
While there are no workarounds, it is recommended to upgrade as soon as possible to mitigate the risk.
Yes, user interaction is necessary to trigger the overflow condition.
You can refer to the official Debian CVE database or the Vim project's release notes for detailed information.
References
Related vulnerabilities
Recent vulnerabilities recorded for vim.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
