Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a :s command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive :s call causes free-ing of memory which may later then be accessed by the initial :s command. The user must intentionally execute the payload and the whole process is a bit tricky to do since it seems to work only reliably for the very first :s command. It may also cause a crash of Vim. Version 9.0.2121 contains a fix for this issue.
{
"cwe_ids": [
"CWE-416"
]
}[
{
"deprecated": false,
"source": "https://github.com/vim/vim/commit/26c11c56888d01e298cd8044caf860f3c26f57bb",
"id": "CVE-2023-48706-03c66c8b",
"digest": {
"line_hashes": [
"58972704091159608642833753396070366932",
"265850537485380442658363201460516660274",
"172008570766993647937329477379985513966",
"215752843720206495008455949962361183446",
"201000829099694697789778474396198371025",
"149203649584607372282427671540238369904",
"96266888488630966991536523415806827285",
"305501921626624863424560827224034058078",
"260086702040576943349751567378347889084",
"20687885217496941236750035624672408787",
"234556526869346910766273881765229769247",
"327411306546362609218980886631251790599",
"249253005322399418382713021650695699341",
"219255933481483413005227924227368619020",
"19954974111493840596731715576398700072",
"3034353505767516185615337243679419955",
"240219872505484471540660904813796308110",
"329730252589971934334194216705535444762",
"289929200825211789374489587384513783467",
"246837499140795187580707939014736972710",
"316963281680792377914030933654081044336",
"104062290674162826969789655610154076516",
"79979787224105835352372781377143531765",
"12729185144437598924608755626458188713",
"302378801626181361875359805629154419709",
"335895873702380946640357848230555277377",
"203083285227504279963168472058091792756",
"141677817966021808951887331227910362076",
"294178628187064523529355927836133492592",
"84670822940795060787979781455149294169",
"317989582218652270429642791333797940855",
"125984270306141789811234985980387422541",
"169648684154511597729358328888476172892",
"317230886938872067969691595847770451635",
"213626224607275058411826184613966037636",
"330886393471490370780998614043183245938",
"298678913763746925850149558652223098086",
"260367956145206506918504622016312875353",
"213649277785249102375811082651234933024",
"305469662498605256573083359316147152856",
"52838678884215330133998923253082650289",
"101478793907769749555101289751796619207",
"126564026313305339106920109261148433928",
"181662525919248788419080493795637925584",
"183475853010225488349829435644110006586",
"168775681825917810476266779569752899197",
"42231153613554962872178028935800354800",
"299401889592436893755086054066272085733",
"137989605422665250121861288831393408735",
"204228813833459910786977882838919492241",
"256270708863361571810719309013023474551",
"158690188353756834878963830233101422768",
"247471190952908054811788263680672268237",
"265067571323441096981189592190079865833",
"157814535575328560059626170466836046752",
"318587491446350728225934590563864406538",
"52416987823816767988336821359069352709",
"271856278347952513265848851558482136543",
"154761988210357361457074702634568671062",
"40793725584169129458575132492116187288",
"147665714538127281742281095340492550785",
"256157635673107849070871498164965105246",
"197389854697531196430769858992005983641",
"157017816085259364318915844069763505621",
"187422187103794871934145182331189199594",
"196321823619300697076949100804610512892",
"262537420136556363305403942860093097457",
"312734638855880420575966981282490739163",
"310546431187206410783444702616607775010",
"327866332966880843790052753761940190425",
"319696829073653965335696596751913432786",
"94241372371818567815639811954509238403",
"23408658823875339822907151894046749299",
"184097104982000931581212321087265673150",
"192125813827388322658767904200466834254",
"253887001093730750779088769875750534343",
"33273382789511236109233794281574895527",
"122567241867223055112860915509162063171",
"28379518015818847442047924650077858474",
"188651504172615873649040463946999744450",
"85637065042933334765314835891997371785",
"66391544943026151718550856539704783677",
"154102045554386368104502201970650297234"
],
"threshold": 0.9
},
"target": {
"file": "src/ex_cmds.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://github.com/vim/vim/commit/26c11c56888d01e298cd8044caf860f3c26f57bb",
"id": "CVE-2023-48706-6b720c6a",
"digest": {
"function_hash": "126862315985033391345350900798057679151",
"length": 16658.0
},
"target": {
"function": "ex_substitute",
"file": "src/ex_cmds.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://github.com/vim/vim/commit/26c11c56888d01e298cd8044caf860f3c26f57bb",
"id": "CVE-2023-48706-99cc3fd0",
"digest": {
"line_hashes": [
"146200493773228420153804765641940418619",
"309485305738506144784440634031534516502",
"18968944470132930394991091305743641460",
"224703688285155022586448453991466304058"
],
"threshold": 0.9
},
"target": {
"file": "src/version.c"
},
"signature_type": "Line",
"signature_version": "v1"
}
]