The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers Buf*
autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying. Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free. Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678.
{ "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "2:7.4.052-1ubuntu3.1+esm18", "binary_name": "vim" }, { "binary_version": "2:7.4.052-1ubuntu3.1+esm18", "binary_name": "vim-athena" }, { "binary_version": "2:7.4.052-1ubuntu3.1+esm18", "binary_name": "vim-athena-dbgsym" }, { "binary_version": "2:7.4.052-1ubuntu3.1+esm18", "binary_name": "vim-common" }, { "binary_version": "2:7.4.052-1ubuntu3.1+esm18", "binary_name": "vim-common-dbgsym" }, { "binary_version": "2:7.4.052-1ubuntu3.1+esm18", "binary_name": "vim-dbg" }, { "binary_version": "2:7.4.052-1ubuntu3.1+esm18", "binary_name": "vim-dbgsym" }, { "binary_version": "2:7.4.052-1ubuntu3.1+esm18", "binary_name": "vim-doc" }, { "binary_version": "2:7.4.052-1ubuntu3.1+esm18", "binary_name": "vim-gnome" }, { "binary_version": "2:7.4.052-1ubuntu3.1+esm18", "binary_name": "vim-gnome-dbgsym" }, { "binary_version": "2:7.4.052-1ubuntu3.1+esm18", "binary_name": "vim-gtk" }, { "binary_version": "2:7.4.052-1ubuntu3.1+esm18", "binary_name": "vim-gtk-dbgsym" }, { "binary_version": "2:7.4.052-1ubuntu3.1+esm18", "binary_name": "vim-gui-common" }, { "binary_version": "2:7.4.052-1ubuntu3.1+esm18", "binary_name": "vim-lesstif" }, { "binary_version": "2:7.4.052-1ubuntu3.1+esm18", "binary_name": "vim-nox" }, { "binary_version": "2:7.4.052-1ubuntu3.1+esm18", "binary_name": "vim-nox-dbgsym" }, { "binary_version": "2:7.4.052-1ubuntu3.1+esm18", "binary_name": "vim-runtime" }, { "binary_version": "2:7.4.052-1ubuntu3.1+esm18", "binary_name": "vim-tiny" }, { "binary_version": "2:7.4.052-1ubuntu3.1+esm18", "binary_name": "vim-tiny-dbgsym" } ] }
{ "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-athena" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-athena-dbgsym" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-athena-py2" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-athena-py2-dbgsym" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-common" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-common-dbgsym" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-dbgsym" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-doc" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-gnome" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-gnome-dbgsym" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-gnome-py2" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-gnome-py2-dbgsym" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-gtk" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-gtk-dbgsym" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-gtk-py2" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-gtk-py2-dbgsym" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-gtk3" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-gtk3-dbgsym" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-gtk3-py2" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-gtk3-py2-dbgsym" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-gui-common" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-nox" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-nox-dbgsym" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-nox-py2" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-nox-py2-dbgsym" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-runtime" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-tiny" }, { "binary_version": "2:7.4.1689-3ubuntu1.5+esm24", "binary_name": "vim-tiny-dbgsym" } ] }
{ "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "2:8.0.1453-1ubuntu1.13+esm9", "binary_name": "vim" }, { "binary_version": "2:8.0.1453-1ubuntu1.13+esm9", "binary_name": "vim-athena" }, { "binary_version": "2:8.0.1453-1ubuntu1.13+esm9", "binary_name": "vim-athena-dbgsym" }, { "binary_version": "2:8.0.1453-1ubuntu1.13+esm9", "binary_name": "vim-common" }, { "binary_version": "2:8.0.1453-1ubuntu1.13+esm9", "binary_name": "vim-dbgsym" }, { "binary_version": "2:8.0.1453-1ubuntu1.13+esm9", "binary_name": "vim-doc" }, { "binary_version": "2:8.0.1453-1ubuntu1.13+esm9", "binary_name": "vim-gnome" }, { "binary_version": "2:8.0.1453-1ubuntu1.13+esm9", "binary_name": "vim-gtk" }, { "binary_version": "2:8.0.1453-1ubuntu1.13+esm9", "binary_name": "vim-gtk-dbgsym" }, { "binary_version": "2:8.0.1453-1ubuntu1.13+esm9", "binary_name": "vim-gtk3" }, { "binary_version": "2:8.0.1453-1ubuntu1.13+esm9", "binary_name": "vim-gtk3-dbgsym" }, { "binary_version": "2:8.0.1453-1ubuntu1.13+esm9", "binary_name": "vim-gui-common" }, { "binary_version": "2:8.0.1453-1ubuntu1.13+esm9", "binary_name": "vim-nox" }, { "binary_version": "2:8.0.1453-1ubuntu1.13+esm9", "binary_name": "vim-nox-dbgsym" }, { "binary_version": "2:8.0.1453-1ubuntu1.13+esm9", "binary_name": "vim-runtime" }, { "binary_version": "2:8.0.1453-1ubuntu1.13+esm9", "binary_name": "vim-tiny" }, { "binary_version": "2:8.0.1453-1ubuntu1.13+esm9", "binary_name": "vim-tiny-dbgsym" }, { "binary_version": "2:8.0.1453-1ubuntu1.13+esm9", "binary_name": "xxd" }, { "binary_version": "2:8.0.1453-1ubuntu1.13+esm9", "binary_name": "xxd-dbgsym" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "2:8.1.2269-1ubuntu5.24", "binary_name": "vim" }, { "binary_version": "2:8.1.2269-1ubuntu5.24", "binary_name": "vim-athena" }, { "binary_version": "2:8.1.2269-1ubuntu5.24", "binary_name": "vim-athena-dbgsym" }, { "binary_version": "2:8.1.2269-1ubuntu5.24", "binary_name": "vim-common" }, { "binary_version": "2:8.1.2269-1ubuntu5.24", "binary_name": "vim-dbgsym" }, { "binary_version": "2:8.1.2269-1ubuntu5.24", "binary_name": "vim-doc" }, { "binary_version": "2:8.1.2269-1ubuntu5.24", "binary_name": "vim-gtk" }, { "binary_version": "2:8.1.2269-1ubuntu5.24", "binary_name": "vim-gtk3" }, { "binary_version": "2:8.1.2269-1ubuntu5.24", "binary_name": "vim-gtk3-dbgsym" }, { "binary_version": "2:8.1.2269-1ubuntu5.24", "binary_name": "vim-gui-common" }, { "binary_version": "2:8.1.2269-1ubuntu5.24", "binary_name": "vim-nox" }, { "binary_version": "2:8.1.2269-1ubuntu5.24", "binary_name": "vim-nox-dbgsym" }, { "binary_version": "2:8.1.2269-1ubuntu5.24", "binary_name": "vim-runtime" }, { "binary_version": "2:8.1.2269-1ubuntu5.24", "binary_name": "vim-tiny" }, { "binary_version": "2:8.1.2269-1ubuntu5.24", "binary_name": "vim-tiny-dbgsym" }, { "binary_version": "2:8.1.2269-1ubuntu5.24", "binary_name": "xxd" }, { "binary_version": "2:8.1.2269-1ubuntu5.24", "binary_name": "xxd-dbgsym" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "2:8.2.3995-1ubuntu2.18", "binary_name": "vim" }, { "binary_version": "2:8.2.3995-1ubuntu2.18", "binary_name": "vim-athena" }, { "binary_version": "2:8.2.3995-1ubuntu2.18", "binary_name": "vim-athena-dbgsym" }, { "binary_version": "2:8.2.3995-1ubuntu2.18", "binary_name": "vim-common" }, { "binary_version": "2:8.2.3995-1ubuntu2.18", "binary_name": "vim-dbgsym" }, { "binary_version": "2:8.2.3995-1ubuntu2.18", "binary_name": "vim-doc" }, { "binary_version": "2:8.2.3995-1ubuntu2.18", "binary_name": "vim-gtk" }, { "binary_version": "2:8.2.3995-1ubuntu2.18", "binary_name": "vim-gtk3" }, { "binary_version": "2:8.2.3995-1ubuntu2.18", "binary_name": "vim-gtk3-dbgsym" }, { "binary_version": "2:8.2.3995-1ubuntu2.18", "binary_name": "vim-gui-common" }, { "binary_version": "2:8.2.3995-1ubuntu2.18", "binary_name": "vim-nox" }, { "binary_version": "2:8.2.3995-1ubuntu2.18", "binary_name": "vim-nox-dbgsym" }, { "binary_version": "2:8.2.3995-1ubuntu2.18", "binary_name": "vim-runtime" }, { "binary_version": "2:8.2.3995-1ubuntu2.18", "binary_name": "vim-tiny" }, { "binary_version": "2:8.2.3995-1ubuntu2.18", "binary_name": "vim-tiny-dbgsym" }, { "binary_version": "2:8.2.3995-1ubuntu2.18", "binary_name": "xxd" }, { "binary_version": "2:8.2.3995-1ubuntu2.18", "binary_name": "xxd-dbgsym" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "2:9.1.0016-1ubuntu7.2", "binary_name": "vim" }, { "binary_version": "2:9.1.0016-1ubuntu7.2", "binary_name": "vim-athena" }, { "binary_version": "2:9.1.0016-1ubuntu7.2", "binary_name": "vim-common" }, { "binary_version": "2:9.1.0016-1ubuntu7.2", "binary_name": "vim-dbgsym" }, { "binary_version": "2:9.1.0016-1ubuntu7.2", "binary_name": "vim-doc" }, { "binary_version": "2:9.1.0016-1ubuntu7.2", "binary_name": "vim-gtk3" }, { "binary_version": "2:9.1.0016-1ubuntu7.2", "binary_name": "vim-gtk3-dbgsym" }, { "binary_version": "2:9.1.0016-1ubuntu7.2", "binary_name": "vim-gui-common" }, { "binary_version": "2:9.1.0016-1ubuntu7.2", "binary_name": "vim-motif" }, { "binary_version": "2:9.1.0016-1ubuntu7.2", "binary_name": "vim-motif-dbgsym" }, { "binary_version": "2:9.1.0016-1ubuntu7.2", "binary_name": "vim-nox" }, { "binary_version": "2:9.1.0016-1ubuntu7.2", "binary_name": "vim-nox-dbgsym" }, { "binary_version": "2:9.1.0016-1ubuntu7.2", "binary_name": "vim-runtime" }, { "binary_version": "2:9.1.0016-1ubuntu7.2", "binary_name": "vim-tiny" }, { "binary_version": "2:9.1.0016-1ubuntu7.2", "binary_name": "vim-tiny-dbgsym" }, { "binary_version": "2:9.1.0016-1ubuntu7.2", "binary_name": "xxd" }, { "binary_version": "2:9.1.0016-1ubuntu7.2", "binary_name": "xxd-dbgsym" } ] }