vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.
{ "vanir_signatures": [ { "id": "CVE-2017-5953-81fd5156", "signature_type": "Function", "target": { "file": "src/spellfile.c", "function": "spell_read_tree" }, "signature_version": "v1", "digest": { "length": 582.0, "function_hash": "270963623728371117107474029981875322174" }, "deprecated": false, "source": "https://github.com/vim/vim/commit/399c297aa93afe2c0a39e2a1b3f972aebba44c9d" }, { "id": "CVE-2017-5953-b356aac5", "signature_type": "Line", "target": { "file": "src/spellfile.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "92673288073310823043741533162792337542", "17808163214729196838027593952031201747", "69718327161397786629207745564951476005", "292252201400447071467488880313594198920" ], "threshold": 0.9 }, "deprecated": false, "source": "https://github.com/vim/vim/commit/399c297aa93afe2c0a39e2a1b3f972aebba44c9d" }, { "id": "CVE-2017-5953-de536671", "signature_type": "Line", "target": { "file": "src/version.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "146200493773228420153804765641940418619", "204897543870975188852231448937125890242", "254252104479503521227150663999463097126", "140813921799221096148041154944335634523" ], "threshold": 0.9 }, "deprecated": false, "source": "https://github.com/vim/vim/commit/399c297aa93afe2c0a39e2a1b3f972aebba44c9d" } ] }