CVE-2023-48237: overflow in shift_line in vim
Last updated 24 July 2024
Other sources
Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit 6bf131888 which has been included in version 9.0.2112. Users are advised to upgrade. There are no known workarounds for this vulnerability.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.1.1230-1 - Upgrade
Upgrade
vimto a version that resolves this vulnerability.Fixed in 9.0.2112Patch 6bf131888
Event History
Frequently Asked Questions
What is CVE-2023-48237?
CVE-2023-48237 is a vulnerability in Vim, an open source command line text editor, that allows integer overflow when shifting lines in operator pending mode.
What is the severity of CVE-2023-48237?
The severity of CVE-2023-48237 is medium with a CVSS score of 4.3.
How does CVE-2023-48237 impact users?
CVE-2023-48237 has a low impact as user interaction is required and a crash may not happen in all situations.
Which software versions are affected by CVE-2023-48237?
Vim versions up to 9.0.2112 and Fedora 39 are affected by CVE-2023-48237.
How can I fix CVE-2023-48237?
Updating Vim to a version beyond 9.0.2112 or updating to a Fedora version beyond 39 can fix CVE-2023-48237.