PT-2023-5105 · Vim+7 · Vim+7

Published 2023-09-02 · Updated 2024-06-15 · CVE-2023-4734

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vim versions prior to 9.0.1846

Description The issue is caused by an integer overflow in the f fullcommand function of the vim text editor. This can allow an attacker to execute arbitrary code. The estimated number of potentially affected devices is not provided, and there is no information about real-world incidents where this issue was exploited.

Recommendations For versions prior to 9.0.1846, update to version 9.0.1846 or later to resolve the issue. As a temporary workaround, consider restricting the use of the f fullcommand function until a patch is available.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2023-5538

ALT-PU-2023-5553

ALT-PU-2023-5877

ALT-PU-2023-5879

AZL-28598

BDU:2023-05671

CVE-2023-4734

ECHO-D272-6D1D-C2EF

OESA-2023-1653

OPENSUSE-SU-2023_3955-1

OPENSUSE-SU-2023_4557-1

OPENSUSE-SU-2024:13226-1

SUSE-SU-2023:3942-1

SUSE-SU-2023:3955-1

SUSE-SU-2023:4557-1

USN-6452-1

Affected Products

Alt Linux

Debian

Linuxmint

Apple Macos

Red Os

Suse

Ubuntu

Vim

References · 84

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4734.json · Exploit
• 🔥 https://huntr.dev/bounties/688e4382-d2b6-439a-a54e-484780f82217 · Exploit
• https://github.com/vim/vim/commit/4c6fe2e2ea62469642ed1d80b16d39e616b25cf5 · Patch
• https://ubuntu.com/security/CVE-2023-4752 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:4557-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6452-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-4735 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-4734 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-4734 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-4733 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:3955-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-3896 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-4734 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6452-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4734 · Security Note