CVE-2023-48235: overflow in ex address parsing in vim
Last updated 24 July 2024
Other sources
Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an overflow. Ironically this happens in the existing overflow check, because the line number becomes negative and LONGMAX - lnum will cause the overflow. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit 060623e which has been included in release version 9.0.2110. Users are advised to upgrade. There are no known workarounds for this vulnerability.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.1.1230-1 - Upgrade
Upgrade
vimto a version that resolves this vulnerability.Fixed in 9.0.2110Patch 060623e
Event History
Frequently Asked Questions
What is CVE-2023-48235?
CVE-2023-48235 is a vulnerability in Vim that occurs when parsing relative ex addresses, leading to an overflow.
What is the impact of CVE-2023-48235?
The impact of CVE-2023-48235 is low, with limited user interaction required.
What software versions are affected by CVE-2023-48235?
Vim versions up to and excluding 9.0.2110 and Fedora 39 are affected by CVE-2023-48235.
How can I fix CVE-2023-48235?
To fix CVE-2023-48235, update Vim to version 9.0.2110 or higher.
Where can I find more information about CVE-2023-48235?
More information about CVE-2023-48235 can be found in the references provided: https://github.com/vim/vim/security/advisories/GHSA-6g74-hr6q-pr8g, https://github.com/vim/vim/commit/060623e4a3bc72b011e7cd92bedb3bfb64e06200, http://www.openwall.com/lists/oss-security/2023/11/16/1