Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648.
{
"cwe_ids": [
"CWE-416"
]
}[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"146200493773228420153804765641940418619",
"319068576336015303654870632066556216911",
"178563506805096978316365411572304971534",
"103866325697220096823787096222625492069"
]
},
"id": "CVE-2024-41965-37ddfcf6",
"signature_type": "Line",
"source": "https://github.com/vim/vim/commit/b29f4abcd4b3382fa746edd1d0562b7b48c9de60",
"target": {
"file": "src/version.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"208460236667585611550014454444459001684",
"47561753496803494013132493144902166888",
"64918886378476369114116130504994470708",
"218441320039957642159090358074181675959",
"279270165435357312255759665662653512285",
"68041810321967682710134210647078424877"
]
},
"id": "CVE-2024-41965-5bb1bb7b",
"signature_type": "Line",
"source": "https://github.com/vim/vim/commit/b29f4abcd4b3382fa746edd1d0562b7b48c9de60",
"target": {
"file": "src/ex_cmds2.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1534.0,
"function_hash": "100140338462924349444709213450817516896"
},
"id": "CVE-2024-41965-cdb60219",
"signature_type": "Function",
"source": "https://github.com/vim/vim/commit/b29f4abcd4b3382fa746edd1d0562b7b48c9de60",
"target": {
"file": "src/ex_cmds2.c",
"function": "dialog_changed"
}
}
]