First published: Fri Oct 27 2023(Updated: )
Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the file `src/alloc.c` at line 748, which is freed in the file `src/ex_docmd.c` in the function `do_cmdline` at line 1010 and then used again in `src/cmdhist.c` at line 759. When using the `:history` command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068.
Credit: security-advisories@github.com security-advisories@github.com
Affected Software | Affected Version | How to fix |
---|---|---|
Vim Vim | <9.0.2068 | |
ubuntu/vim | <2:8.0.1453-1ubuntu1.13+ | 2:8.0.1453-1ubuntu1.13+ |
ubuntu/vim | <2:8.1.2269-1ubuntu5.21 | 2:8.1.2269-1ubuntu5.21 |
ubuntu/vim | <2:8.2.3995-1ubuntu2.15 | 2:8.2.3995-1ubuntu2.15 |
ubuntu/vim | <2:9.0.1000-4ubuntu3.3 | 2:9.0.1000-4ubuntu3.3 |
ubuntu/vim | <2:9.0.1672-1ubuntu2.2 | 2:9.0.1672-1ubuntu2.2 |
ubuntu/vim | <2:7.4.052-1ubuntu3.1+ | 2:7.4.052-1ubuntu3.1+ |
ubuntu/vim | <2:7.4.1689-3ubuntu1.5+ | 2:7.4.1689-3ubuntu1.5+ |
debian/vim | <=2:8.1.0875-5+deb10u2<=2:8.1.0875-5+deb10u6<=2:8.2.2434-3+deb11u1<=2:9.0.1378-2 | 2:9.1.0016-1 2:9.1.0377-1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2023-46246 is a vulnerability in Vim, a text editor, that allows for a heap-use-after-free vulnerability in the memory allocation process.
CVE-2023-46246 has a severity rating of medium with a severity value of 5.5.
Vim versions up to and excluding 9.0.2068 are affected by CVE-2023-46246.
To fix CVE-2023-46246, users should update to a version of Vim that is newer than 9.0.2068.
More information about CVE-2023-46246 can be found at the following references: [GitHub Commit](https://github.com/vim/vim/commit/9198c1f2b1ddecde22af918541e0de2a32f0f45a) and [GitHub Security Advisory](https://github.com/vim/vim/security/advisories/GHSA-q22m-h7m2-9mgm).