REDHAT-BUG-2437843: Buffer Overflow
Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The vulnerability is located in the gettagfname() function in src/tag.c. When processing help file tags, Vim copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been patched in version 9.1.2132.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vimto a version that resolves this vulnerability.Fixed in 9.1.2132
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2437843?
The severity of REDHAT-BUG-2437843 is classified as a heap buffer overflow vulnerability.
How do I fix REDHAT-BUG-2437843?
To fix REDHAT-BUG-2437843, upgrade Vim to version 9.1.2132 or later.
What versions of Vim are affected by REDHAT-BUG-2437843?
Vim versions prior to 9.1.2132 are affected by REDHAT-BUG-2437843.
What specific function in Vim is vulnerable in REDHAT-BUG-2437843?
The vulnerable function in Vim is get_tagfname() located in src/tag.c.
What type of vulnerability is REDHAT-BUG-2437843?
REDHAT-BUG-2437843 is a heap buffer overflow vulnerability.