Critical Overflow Vulnerability in Vim Package: CVE-2023-48235
Summary
UBUNTU-CVE-2023-48235: Vim is an open source command line text editor. Affects vim versions < 2:7.4.052-1ubuntu3.1+esm15. Fixed in 2:7.4.052-1ubuntu3.1+esm15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is a widely used open-source command line text editor known for its efficiency and versatility in editing text files. It supports various programming languages and offers features such as syntax highlighting, multi-level undo, and customizable key mappings. However, it is susceptible to a specific vulnerability that can lead to unexpected behavior when parsing relative ex addresses.
Vulnerability Detail
The vulnerability, identified as CVE-2023-48235, arises from an overflow condition triggered when Vim processes relative ex addresses. This issue occurs due to a flaw in the existing overflow check, where the line number can become negative, leading to an overflow when calculating LONG_MAX - lnum. Although the impact is low and requires user interaction, it may result in a crash in certain scenarios, making it essential for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
2:7.4.052-1ubuntu3.1+esm15
This is the first release that contains the fix.
sudo apt-get install --only-upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. Users are advised to upgrade to the patched versions as soon as possible.
Conclusion
CVE-2023-48235 is a critical overflow vulnerability in the Vim package that requires immediate attention from users. By updating to the patched versions, users can mitigate the risk associated with this vulnerability and ensure the continued security of their systems.
See every vulnerability recorded for vim →
FAQ
CVE-2023-48235 is a vulnerability in the Vim text editor that can lead to an overflow condition when processing relative ex addresses.
The vulnerability requires user interaction and may lead to unexpected crashes in certain situations, although the overall impact is considered low.
Affected versions include various releases of Vim across Ubuntu distributions, specifically those prior to the patched versions listed in the 'how_to_fix' section.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for CVE-2023-48235 is 4.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for vim.
