Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function ga_grow_inner
in in the file src/alloc.c
at line 748, which is freed in the file src/ex_docmd.c
in the function do_cmdline
at line 1010 and then used again in src/cmdhist.c
at line 759. When using the :history
command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068.
{ "binaries": [ { "binary_name": "vim", "binary_version": "2:7.4.052-1ubuntu3.1+esm15" }, { "binary_name": "vim-athena", "binary_version": "2:7.4.052-1ubuntu3.1+esm15" }, { "binary_name": "vim-athena-dbgsym", "binary_version": "2:7.4.052-1ubuntu3.1+esm15" }, { "binary_name": "vim-common", "binary_version": "2:7.4.052-1ubuntu3.1+esm15" }, { "binary_name": "vim-common-dbgsym", "binary_version": "2:7.4.052-1ubuntu3.1+esm15" }, { "binary_name": "vim-dbg", "binary_version": "2:7.4.052-1ubuntu3.1+esm15" }, { "binary_name": "vim-dbgsym", "binary_version": "2:7.4.052-1ubuntu3.1+esm15" }, { "binary_name": "vim-doc", "binary_version": "2:7.4.052-1ubuntu3.1+esm15" }, { "binary_name": "vim-gnome", "binary_version": "2:7.4.052-1ubuntu3.1+esm15" }, { "binary_name": "vim-gnome-dbgsym", "binary_version": "2:7.4.052-1ubuntu3.1+esm15" }, { "binary_name": "vim-gtk", "binary_version": "2:7.4.052-1ubuntu3.1+esm15" }, { "binary_name": "vim-gtk-dbgsym", "binary_version": "2:7.4.052-1ubuntu3.1+esm15" }, { "binary_name": "vim-gui-common", "binary_version": "2:7.4.052-1ubuntu3.1+esm15" }, { "binary_name": "vim-lesstif", "binary_version": "2:7.4.052-1ubuntu3.1+esm15" }, { "binary_name": "vim-nox", "binary_version": "2:7.4.052-1ubuntu3.1+esm15" }, { "binary_name": "vim-nox-dbgsym", "binary_version": "2:7.4.052-1ubuntu3.1+esm15" }, { "binary_name": "vim-runtime", "binary_version": "2:7.4.052-1ubuntu3.1+esm15" }, { "binary_name": "vim-tiny", "binary_version": "2:7.4.052-1ubuntu3.1+esm15" }, { "binary_name": "vim-tiny-dbgsym", "binary_version": "2:7.4.052-1ubuntu3.1+esm15" } ], "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "ubuntu_priority": "medium" }
{ "binaries": [ { "binary_name": "vim", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-athena", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-athena-dbgsym", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-athena-py2", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-athena-py2-dbgsym", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-common", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-common-dbgsym", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-dbgsym", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-doc", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-gnome", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-gnome-dbgsym", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-gnome-py2", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-gnome-py2-dbgsym", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-gtk", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-gtk-dbgsym", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-gtk-py2", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-gtk-py2-dbgsym", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-gtk3", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-gtk3-dbgsym", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-gtk3-py2", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-gtk3-py2-dbgsym", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-gui-common", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-nox", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-nox-dbgsym", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-nox-py2", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-nox-py2-dbgsym", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-runtime", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-tiny", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" }, { "binary_name": "vim-tiny-dbgsym", "binary_version": "2:7.4.1689-3ubuntu1.5+esm22" } ], "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "ubuntu_priority": "medium" }
{ "binaries": [ { "binary_name": "vim", "binary_version": "2:8.0.1453-1ubuntu1.13+esm7" }, { "binary_name": "vim-athena", "binary_version": "2:8.0.1453-1ubuntu1.13+esm7" }, { "binary_name": "vim-athena-dbgsym", "binary_version": "2:8.0.1453-1ubuntu1.13+esm7" }, { "binary_name": "vim-common", "binary_version": "2:8.0.1453-1ubuntu1.13+esm7" }, { "binary_name": "vim-dbgsym", "binary_version": "2:8.0.1453-1ubuntu1.13+esm7" }, { "binary_name": "vim-doc", "binary_version": "2:8.0.1453-1ubuntu1.13+esm7" }, { "binary_name": "vim-gnome", "binary_version": "2:8.0.1453-1ubuntu1.13+esm7" }, { "binary_name": "vim-gtk", "binary_version": "2:8.0.1453-1ubuntu1.13+esm7" }, { "binary_name": "vim-gtk-dbgsym", "binary_version": "2:8.0.1453-1ubuntu1.13+esm7" }, { "binary_name": "vim-gtk3", "binary_version": "2:8.0.1453-1ubuntu1.13+esm7" }, { "binary_name": "vim-gtk3-dbgsym", "binary_version": "2:8.0.1453-1ubuntu1.13+esm7" }, { "binary_name": "vim-gui-common", "binary_version": "2:8.0.1453-1ubuntu1.13+esm7" }, { "binary_name": "vim-nox", "binary_version": "2:8.0.1453-1ubuntu1.13+esm7" }, { "binary_name": "vim-nox-dbgsym", "binary_version": "2:8.0.1453-1ubuntu1.13+esm7" }, { "binary_name": "vim-runtime", "binary_version": "2:8.0.1453-1ubuntu1.13+esm7" }, { "binary_name": "vim-tiny", "binary_version": "2:8.0.1453-1ubuntu1.13+esm7" }, { "binary_name": "vim-tiny-dbgsym", "binary_version": "2:8.0.1453-1ubuntu1.13+esm7" }, { "binary_name": "xxd", "binary_version": "2:8.0.1453-1ubuntu1.13+esm7" }, { "binary_name": "xxd-dbgsym", "binary_version": "2:8.0.1453-1ubuntu1.13+esm7" } ], "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "ubuntu_priority": "medium" }
{ "binaries": [ { "binary_name": "vim", "binary_version": "2:8.1.2269-1ubuntu5.21" }, { "binary_name": "vim-athena", "binary_version": "2:8.1.2269-1ubuntu5.21" }, { "binary_name": "vim-athena-dbgsym", "binary_version": "2:8.1.2269-1ubuntu5.21" }, { "binary_name": "vim-common", "binary_version": "2:8.1.2269-1ubuntu5.21" }, { "binary_name": "vim-dbgsym", "binary_version": "2:8.1.2269-1ubuntu5.21" }, { "binary_name": "vim-doc", "binary_version": "2:8.1.2269-1ubuntu5.21" }, { "binary_name": "vim-gtk", "binary_version": "2:8.1.2269-1ubuntu5.21" }, { "binary_name": "vim-gtk3", "binary_version": "2:8.1.2269-1ubuntu5.21" }, { "binary_name": "vim-gtk3-dbgsym", "binary_version": "2:8.1.2269-1ubuntu5.21" }, { "binary_name": "vim-gui-common", "binary_version": "2:8.1.2269-1ubuntu5.21" }, { "binary_name": "vim-nox", "binary_version": "2:8.1.2269-1ubuntu5.21" }, { "binary_name": "vim-nox-dbgsym", "binary_version": "2:8.1.2269-1ubuntu5.21" }, { "binary_name": "vim-runtime", "binary_version": "2:8.1.2269-1ubuntu5.21" }, { "binary_name": "vim-tiny", "binary_version": "2:8.1.2269-1ubuntu5.21" }, { "binary_name": "vim-tiny-dbgsym", "binary_version": "2:8.1.2269-1ubuntu5.21" }, { "binary_name": "xxd", "binary_version": "2:8.1.2269-1ubuntu5.21" }, { "binary_name": "xxd-dbgsym", "binary_version": "2:8.1.2269-1ubuntu5.21" } ], "availability": "No subscription required", "ubuntu_priority": "medium" }
{ "binaries": [ { "binary_name": "vim", "binary_version": "2:8.2.3995-1ubuntu2.15" }, { "binary_name": "vim-athena", "binary_version": "2:8.2.3995-1ubuntu2.15" }, { "binary_name": "vim-athena-dbgsym", "binary_version": "2:8.2.3995-1ubuntu2.15" }, { "binary_name": "vim-common", "binary_version": "2:8.2.3995-1ubuntu2.15" }, { "binary_name": "vim-dbgsym", "binary_version": "2:8.2.3995-1ubuntu2.15" }, { "binary_name": "vim-doc", "binary_version": "2:8.2.3995-1ubuntu2.15" }, { "binary_name": "vim-gtk", "binary_version": "2:8.2.3995-1ubuntu2.15" }, { "binary_name": "vim-gtk3", "binary_version": "2:8.2.3995-1ubuntu2.15" }, { "binary_name": "vim-gtk3-dbgsym", "binary_version": "2:8.2.3995-1ubuntu2.15" }, { "binary_name": "vim-gui-common", "binary_version": "2:8.2.3995-1ubuntu2.15" }, { "binary_name": "vim-nox", "binary_version": "2:8.2.3995-1ubuntu2.15" }, { "binary_name": "vim-nox-dbgsym", "binary_version": "2:8.2.3995-1ubuntu2.15" }, { "binary_name": "vim-runtime", "binary_version": "2:8.2.3995-1ubuntu2.15" }, { "binary_name": "vim-tiny", "binary_version": "2:8.2.3995-1ubuntu2.15" }, { "binary_name": "vim-tiny-dbgsym", "binary_version": "2:8.2.3995-1ubuntu2.15" }, { "binary_name": "xxd", "binary_version": "2:8.2.3995-1ubuntu2.15" }, { "binary_name": "xxd-dbgsym", "binary_version": "2:8.2.3995-1ubuntu2.15" } ], "availability": "No subscription required", "ubuntu_priority": "medium" }
{ "binaries": [ { "binary_name": "vim", "binary_version": "2:9.1.0-1ubuntu1" }, { "binary_name": "vim-athena", "binary_version": "2:9.1.0-1ubuntu1" }, { "binary_name": "vim-common", "binary_version": "2:9.1.0-1ubuntu1" }, { "binary_name": "vim-dbgsym", "binary_version": "2:9.1.0-1ubuntu1" }, { "binary_name": "vim-doc", "binary_version": "2:9.1.0-1ubuntu1" }, { "binary_name": "vim-gtk3", "binary_version": "2:9.1.0-1ubuntu1" }, { "binary_name": "vim-gtk3-dbgsym", "binary_version": "2:9.1.0-1ubuntu1" }, { "binary_name": "vim-gui-common", "binary_version": "2:9.1.0-1ubuntu1" }, { "binary_name": "vim-motif", "binary_version": "2:9.1.0-1ubuntu1" }, { "binary_name": "vim-motif-dbgsym", "binary_version": "2:9.1.0-1ubuntu1" }, { "binary_name": "vim-nox", "binary_version": "2:9.1.0-1ubuntu1" }, { "binary_name": "vim-nox-dbgsym", "binary_version": "2:9.1.0-1ubuntu1" }, { "binary_name": "vim-runtime", "binary_version": "2:9.1.0-1ubuntu1" }, { "binary_name": "vim-tiny", "binary_version": "2:9.1.0-1ubuntu1" }, { "binary_name": "vim-tiny-dbgsym", "binary_version": "2:9.1.0-1ubuntu1" }, { "binary_name": "xxd", "binary_version": "2:9.1.0-1ubuntu1" }, { "binary_name": "xxd-dbgsym", "binary_version": "2:9.1.0-1ubuntu1" } ], "availability": "No subscription required", "ubuntu_priority": "medium" }