CVE-2023-48233: overflow with count for :s command in vim
Last updated 24 July 2024
Other sources
Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abort with evaluetoolarge. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit ac6378773 which has been included in release version 9.0.2108. Users are advised to upgrade. There are no known workarounds for this vulnerability.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.1.1230-1 - Upgrade
Upgrade
vimto a version that resolves this vulnerability.Fixed in 9.0.2108 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch ac6378773
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-48233.
What is the severity level of CVE-2023-48233?
The severity level of CVE-2023-48233 is medium.
What software is affected by CVE-2023-48233?
Vim version up to 9.0.2108 and Fedora version 39 are affected by CVE-2023-48233.
Is user interaction required for this vulnerability?
Yes, user interaction is required for CVE-2023-48233.
How can I fix CVE-2023-48233?
To fix CVE-2023-48233, update Vim to a version that includes the fix or apply the necessary patch provided by the vendor.