PT-2023-6802 · Vim+8 · Vim+8

Brammool · Publicado 2023-03-24 · Atualizado 2024-06-15 · CVE-2023-2609

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vim versions prior to 9.0.1531

Description The issue is related to a NULL Pointer Dereference in the get register() function, which can be exploited to gain access to confidential data, compromise data integrity, and cause a denial of service. The vulnerability is associated with errors in pointer dereferencing in the Vim text editor.

Recommendations For versions prior to 9.0.1531, update to version 9.0.1531 or later to resolve the issue. As a temporary workaround, consider disabling the get register() function until a patch is available.

Exploit

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALT-PU-2023-1955

ALT-PU-2023-2008

ALT-PU-2023-2024

ALT-PU-2023-2089

AZL-26695

BDU:2023-07669

CVE-2023-2609

ECHO-C757-B71B-5DEF

OESA-2023-1281

OPENSUSE-SU-2023_2640-1

OPENSUSE-SU-2023_3497-1

OPENSUSE-SU-2024:12934-1

SUSE-SU-2023:2640-1

SUSE-SU-2023:3463-1

SUSE-SU-2023:3497-1

USN-6154-1

Produtos afetados

Alt Linux

Astra Linux

Debian

Linuxmint

Apple Macos

Red Os

Suse

Ubuntu

Vim

Referências · 61

• 🔥 https://huntr.dev/bounties/1679be5a-565f-4a44-a430-836412a0b622 · Exploit
• https://github.com/vim/vim/commit/d1ae8366aff286d41e7f5bc513cc0a1af5130aad · Correção
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-vim-cve-2023-2609 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2609 · Nota
• https://suse.com/security/cve/CVE-2023-2610 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-2609 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2023-1264 · Nota
• https://t.me/cvenotify/51026 · Publicação no Telegram
• https://bugzilla.suse.com/1211256 · Nota
• https://osv.dev/vulnerability/BELL-CVE-2023-2609 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2023:3497-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-2609 · Nota de Segurança
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.8 · Nota
• https://bugzilla.suse.com/1209187 · Nota
• https://cve.org/CVERecord?id=CVE-2023-2609 · Nota de Segurança