USN-6993-1: Vim vulnerabilities
It was discovered that Vim incorrectly handled memory when closing a window, leading to a double-free vulnerability. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. (CVE-2024-41957) It was discovered that Vim incorrectly handled memory when adding a new file to an argument list, leading to a use-after-free. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service. (CVE-2024-43374)
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-6993-1?
The severity of USN-6993-1 is high due to its potential to lead to denial of service or arbitrary code execution.
How do I fix USN-6993-1?
To fix USN-6993-1, update Vim to the recommended version for your Ubuntu release as detailed in the advisory.
Which versions of Vim are affected by USN-6993-1?
USN-6993-1 affects multiple versions of Vim across Ubuntu 14.04 to 24.04.
What is a double-free vulnerability as mentioned in USN-6993-1?
A double-free vulnerability occurs when an application erroneously frees the same memory location twice, potentially leading to crashes or execution of malicious code.
What should I do if I cannot update Vim to mitigate USN-6993-1?
If you cannot update Vim, consider avoiding the use of untrusted files with Vim until the issue is resolved.