Vulnerability in Vim: Potential Overflow Issue with z= Command
Summary
DEBIAN-CVE-2023-48236: Vim is an open source command line text editor. Affects vim versions < 2:9.0.2116-1. Fixed in 2:9.0.2116-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is a widely used open-source command line text editor known for its efficiency and versatility. It supports various programming languages and offers features like syntax highlighting, multi-level undo, and extensive customization options. However, a recently identified vulnerability could lead to unexpected behavior when using the z= command, particularly under certain conditions.
Vulnerability Detail
The vulnerability arises from the ability of users to overflow the count with values larger than MAX_INT when executing the z= command in Vim. This issue can result in a crash, although the impact is considered low as it requires user interaction and may not always lead to a crash. The vulnerability has been addressed in commit 73b2d379, included in release version 9.0.2111.
How To Fix
Minimum fixed version
2:9.0.2116-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability, and users are advised to upgrade to the patched version as soon as possible.
Conclusion
In summary, a vulnerability in Vim related to the z= command could lead to potential crashes due to integer overflow. Users are strongly encouraged to upgrade to the latest patched version to mitigate any risks associated with this issue.
See every vulnerability recorded for vim →
FAQ
The vulnerability allows for an overflow of the count when using the z= command, which may lead to crashes under certain conditions.
You can check your version of Vim by running vim --version in the terminal. If it is earlier than 2:9.0.2116-1, it is affected.
Yes, user interaction is required as the vulnerability is triggered by executing the z= command.
While there are no workarounds, it is recommended to limit the use of the z= command until you can upgrade to the patched version.
More details can be found in the official Debian CVE database at the provided source link.
References
Related vulnerabilities
Recent vulnerabilities recorded for vim.
