CVE-2023-46246: Integer Overflow in :history command in Vim
Last updated 24 July 2024
Other sources
Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function gagrowinner in in the file src/alloc.c at line 748, which is freed in the file src/exdocmd.c in the function docmdline at line 1010 and then used again in src/cmdhist.c at line 759. When using the :history command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.1.1230-1 - Upgrade
Upgrade
Vimto a version that resolves this vulnerability.Fixed in 9.0.2068
Event History
Frequently Asked Questions
What is CVE-2023-46246?
CVE-2023-46246 is a vulnerability in Vim, a text editor, that allows for a heap-use-after-free vulnerability in the memory allocation process.
How severe is CVE-2023-46246?
CVE-2023-46246 has a severity rating of medium with a severity value of 5.5.
Which software versions are affected by CVE-2023-46246?
Vim versions up to and excluding 9.0.2068 are affected by CVE-2023-46246.
How can I fix CVE-2023-46246?
To fix CVE-2023-46246, users should update to a version of Vim that is newer than 9.0.2068.
Where can I find more information about CVE-2023-46246?
More information about CVE-2023-46246 can be found at the following references: [GitHub Commit](https://github.com/vim/vim/commit/9198c1f2b1ddecde22af918541e0de2a32f0f45a) and [GitHub Security Advisory](https://github.com/vim/vim/security/advisories/GHSA-q22m-h7m2-9mgm).