Heap Buffer Overflow in Vim Package: CVE-2024-43802
Summary
UBUNTU-CVE-2024-43802: Vim is an improved version of the unix vi text editor. Affects vim versions < 2:7.4.052-1ubuntu3.1+esm19. Fixed in 2:7.4.052-1ubuntu3.1+esm19. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is an enhanced version of the Unix vi text editor, widely used for its powerful text editing capabilities. It supports various programming languages and offers features like syntax highlighting, multi-level undo, and extensive customization options. However, it has been found to have a vulnerability that could lead to a heap buffer overflow, affecting its stability and security.
Vulnerability Detail
The vulnerability identified as CVE-2024-43802 occurs when Vim flushes the typeahead buffer. During this process, Vim moves the current position in the buffer without verifying if there is sufficient space for the next characters. This oversight can cause the tb_off position within the typebuf variable to point outside the valid buffer size, potentially leading to a heap-buffer overflow in functions like ins_typebuf(). The issue is triggered under specific conditions, such as error messages combined with multiple long mappings, which makes it difficult to reproduce. Although the impact is considered low due to its specific requirements, it can result in a crash when it occurs.
How To Fix
Minimum fixed version
2:7.4.052-1ubuntu3.1+esm19
This is the first release that contains the fix.
sudo apt-get install --only-upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no known workarounds for this issue. Users are advised to upgrade to the patched version of Vim to mitigate the risk.
Conclusion
CVE-2024-43802 is a significant vulnerability in the Vim text editor that can lead to crashes due to a heap buffer overflow. Users are strongly encouraged to update to the latest patched version to ensure their systems remain secure.
See every vulnerability recorded for vim →
FAQ
CVE-2024-43802 is a vulnerability in the Vim text editor that can lead to a heap buffer overflow, potentially causing crashes.
The vulnerability can cause Vim to crash under specific conditions, particularly when error messages occur alongside multiple long mappings.
If you are using versions prior to the patched versions listed in the vulnerability details, your version may be affected.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without requiring signup.
The CVSS score for CVE-2024-43802 is 4.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for vim.
