Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648.
{
"cwe_ids": [
"CWE-416"
]
}[
{
"source": "https://github.com/vim/vim/commit/b29f4abcd4b3382fa746edd1d0562b7b48c9de60",
"signature_version": "v1",
"digest": {
"line_hashes": [
"146200493773228420153804765641940418619",
"319068576336015303654870632066556216911",
"178563506805096978316365411572304971534",
"103866325697220096823787096222625492069"
],
"threshold": 0.9
},
"target": {
"file": "src/version.c"
},
"id": "CVE-2024-41965-37ddfcf6",
"deprecated": false,
"signature_type": "Line"
},
{
"source": "https://github.com/vim/vim/commit/b29f4abcd4b3382fa746edd1d0562b7b48c9de60",
"signature_version": "v1",
"digest": {
"line_hashes": [
"208460236667585611550014454444459001684",
"47561753496803494013132493144902166888",
"64918886378476369114116130504994470708",
"218441320039957642159090358074181675959",
"279270165435357312255759665662653512285",
"68041810321967682710134210647078424877"
],
"threshold": 0.9
},
"target": {
"file": "src/ex_cmds2.c"
},
"id": "CVE-2024-41965-5bb1bb7b",
"deprecated": false,
"signature_type": "Line"
},
{
"source": "https://github.com/vim/vim/commit/b29f4abcd4b3382fa746edd1d0562b7b48c9de60",
"signature_version": "v1",
"digest": {
"function_hash": "100140338462924349444709213450817516896",
"length": 1534.0
},
"target": {
"function": "dialog_changed",
"file": "src/ex_cmds2.c"
},
"id": "CVE-2024-41965-cdb60219",
"deprecated": false,
"signature_type": "Function"
}
]