PT-2023-4727 · Vim+5 · Vim+5
Published
2023-01-22
·
Updated
2024-09-11
·
CVE-2023-4751
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
vim versions prior to 9.0.1331
Description
The issue is related to a heap-based buffer overflow in the vim text editor, specifically concerning the utfc ptr2len() function, which can lead to an out-of-bounds operation in memory. Exploitation of this issue may allow an attacker to execute arbitrary code. A use-after-free issue was also addressed with improved memory management.
Recommendations
For versions prior to 9.0.1331, update to version 9.0.1331 or later to resolve the issue. As a temporary workaround, consider disabling the utfc ptr2len() function until a patch is available. Restrict access to the vulnerable vim repository to minimize the risk of exploitation. Avoid using the vulnerable function in the affected vim versions until the issue is resolved.
Exploit
Fix
Memory Corruption
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Linuxmint
Apple Macos
Red Os
Ubuntu
Vim