PT-2023-6802 · Vim+8 · Vim+8

Brammool · Published 2023-03-24 · Updated 2024-06-15 · CVE-2023-2609

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vim versions prior to 9.0.1531

Description The issue is related to a NULL Pointer Dereference in the get register() function, which can be exploited to gain access to confidential data, compromise data integrity, and cause a denial of service. The vulnerability is associated with errors in pointer dereferencing in the Vim text editor.

Recommendations For versions prior to 9.0.1531, update to version 9.0.1531 or later to resolve the issue. As a temporary workaround, consider disabling the get register() function until a patch is available.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2023-1955

ALT-PU-2023-2008

ALT-PU-2023-2024

ALT-PU-2023-2089

AZL-26695

BDU:2023-07669

CVE-2023-2609

ECHO-C757-B71B-5DEF

OESA-2023-1281

OPENSUSE-SU-2023_2640-1

OPENSUSE-SU-2023_3497-1

OPENSUSE-SU-2024:12934-1

SUSE-SU-2023:2640-1

SUSE-SU-2023:3463-1

SUSE-SU-2023:3497-1

USN-6154-1

Affected Products

Alt Linux

Astra Linux

Debian

Linuxmint

Apple Macos

Red Os

Suse

Ubuntu

Vim

References · 61

• 🔥 https://huntr.dev/bounties/1679be5a-565f-4a44-a430-836412a0b622 · Exploit
• https://github.com/vim/vim/commit/d1ae8366aff286d41e7f5bc513cc0a1af5130aad · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-2609 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2023-2609 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:3497-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2609 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-2609 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2609 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-26695 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PCLJN4QINITA3ZASKLEJ64C5TFNKELMO · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1281 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-2609 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6154-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/695326 · Security Note
• https://ubuntu.com/security/CVE-2023-2610 · Vendor Advisory