Integer Overflow in :history command in Vim
CVE-2023-46246

5.5MEDIUM

Key Information:

Vendor

Vim

Status
Vim
Vendor
CVE Published:
27 October 2023

What is CVE-2023-46246?

Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function ga_grow_inner in in the file src/alloc.c at line 748, which is freed in the file src/ex_docmd.c in the function do_cmdline at line 1010 and then used again in src/cmdhist.c at line 759. When using the :history command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068.

Affected Version(s)

vim <= 9.0.2067

References

https://github.com/vim/vim/security/advisories/GHSA-q22m-...
x_refsource_CONFIRM
https://github.com/vim/vim/commit/9198c1f2b1ddecde22af918...
x_refsource_MISC
https://security.netapp.com/advisory/ntap-20231208-0006/

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-46246 : Integer Overflow in :history command in Vim