Vim is an open source, command line text editor. Prior to 9.2.0670, gettextprops() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a floor that guarantees room for a single entry; the count is never checked against the amount of data actually present. A line that declares a large count while carrying little data causes consumers to read far past the end of the line buffer. Such a line can be delivered through a crafted undo file, leading to a crash. This vulnerability is fixed in 9.2.0670.
{
"binaries": [
{
"binary_version": "2:8.2.3995-1ubuntu2.32",
"binary_name": "vim"
},
{
"binary_version": "2:8.2.3995-1ubuntu2.32",
"binary_name": "vim-athena"
},
{
"binary_version": "2:8.2.3995-1ubuntu2.32",
"binary_name": "vim-common"
},
{
"binary_version": "2:8.2.3995-1ubuntu2.32",
"binary_name": "vim-gtk"
},
{
"binary_version": "2:8.2.3995-1ubuntu2.32",
"binary_name": "vim-gtk3"
},
{
"binary_version": "2:8.2.3995-1ubuntu2.32",
"binary_name": "vim-gui-common"
},
{
"binary_version": "2:8.2.3995-1ubuntu2.32",
"binary_name": "vim-nox"
},
{
"binary_version": "2:8.2.3995-1ubuntu2.32",
"binary_name": "vim-runtime"
},
{
"binary_version": "2:8.2.3995-1ubuntu2.32",
"binary_name": "vim-tiny"
},
{
"binary_version": "2:8.2.3995-1ubuntu2.32",
"binary_name": "xxd"
}
]
}{
"binaries": [
{
"binary_version": "2:9.1.0016-1ubuntu7.16",
"binary_name": "vim"
},
{
"binary_version": "2:9.1.0016-1ubuntu7.16",
"binary_name": "vim-athena"
},
{
"binary_version": "2:9.1.0016-1ubuntu7.16",
"binary_name": "vim-common"
},
{
"binary_version": "2:9.1.0016-1ubuntu7.16",
"binary_name": "vim-gtk3"
},
{
"binary_version": "2:9.1.0016-1ubuntu7.16",
"binary_name": "vim-gui-common"
},
{
"binary_version": "2:9.1.0016-1ubuntu7.16",
"binary_name": "vim-motif"
},
{
"binary_version": "2:9.1.0016-1ubuntu7.16",
"binary_name": "vim-nox"
},
{
"binary_version": "2:9.1.0016-1ubuntu7.16",
"binary_name": "vim-runtime"
},
{
"binary_version": "2:9.1.0016-1ubuntu7.16",
"binary_name": "vim-tiny"
},
{
"binary_version": "2:9.1.0016-1ubuntu7.16",
"binary_name": "xxd"
}
]
}{
"binaries": [
{
"binary_version": "2:9.1.0967-1ubuntu6.7",
"binary_name": "vim"
},
{
"binary_version": "2:9.1.0967-1ubuntu6.7",
"binary_name": "vim-athena"
},
{
"binary_version": "2:9.1.0967-1ubuntu6.7",
"binary_name": "vim-common"
},
{
"binary_version": "2:9.1.0967-1ubuntu6.7",
"binary_name": "vim-gtk3"
},
{
"binary_version": "2:9.1.0967-1ubuntu6.7",
"binary_name": "vim-gui-common"
},
{
"binary_version": "2:9.1.0967-1ubuntu6.7",
"binary_name": "vim-motif"
},
{
"binary_version": "2:9.1.0967-1ubuntu6.7",
"binary_name": "vim-nox"
},
{
"binary_version": "2:9.1.0967-1ubuntu6.7",
"binary_name": "vim-runtime"
},
{
"binary_version": "2:9.1.0967-1ubuntu6.7",
"binary_name": "vim-tiny"
},
{
"binary_version": "2:9.1.0967-1ubuntu6.7",
"binary_name": "xxd"
}
]
}{
"binaries": [
{
"binary_version": "2:9.1.2141-1ubuntu4.5",
"binary_name": "vim"
},
{
"binary_version": "2:9.1.2141-1ubuntu4.5",
"binary_name": "vim-common"
},
{
"binary_version": "2:9.1.2141-1ubuntu4.5",
"binary_name": "vim-gtk3"
},
{
"binary_version": "2:9.1.2141-1ubuntu4.5",
"binary_name": "vim-gui-common"
},
{
"binary_version": "2:9.1.2141-1ubuntu4.5",
"binary_name": "vim-motif"
},
{
"binary_version": "2:9.1.2141-1ubuntu4.5",
"binary_name": "vim-nox"
},
{
"binary_version": "2:9.1.2141-1ubuntu4.5",
"binary_name": "vim-runtime"
},
{
"binary_version": "2:9.1.2141-1ubuntu4.5",
"binary_name": "vim-tiny"
},
{
"binary_version": "2:9.1.2141-1ubuntu4.5",
"binary_name": "xxd"
}
]
}{
"binaries": [
{
"binary_version": "2:7.4.052-1ubuntu3.1+esm29",
"binary_name": "vim"
},
{
"binary_version": "2:7.4.052-1ubuntu3.1+esm29",
"binary_name": "vim-athena"
},
{
"binary_version": "2:7.4.052-1ubuntu3.1+esm29",
"binary_name": "vim-common"
},
{
"binary_version": "2:7.4.052-1ubuntu3.1+esm29",
"binary_name": "vim-gnome"
},
{
"binary_version": "2:7.4.052-1ubuntu3.1+esm29",
"binary_name": "vim-gtk"
},
{
"binary_version": "2:7.4.052-1ubuntu3.1+esm29",
"binary_name": "vim-gui-common"
},
{
"binary_version": "2:7.4.052-1ubuntu3.1+esm29",
"binary_name": "vim-lesstif"
},
{
"binary_version": "2:7.4.052-1ubuntu3.1+esm29",
"binary_name": "vim-nox"
},
{
"binary_version": "2:7.4.052-1ubuntu3.1+esm29",
"binary_name": "vim-runtime"
},
{
"binary_version": "2:7.4.052-1ubuntu3.1+esm29",
"binary_name": "vim-tiny"
}
]
}{
"binaries": [
{
"binary_version": "2:7.4.1689-3ubuntu1.5+esm35",
"binary_name": "vim"
},
{
"binary_version": "2:7.4.1689-3ubuntu1.5+esm35",
"binary_name": "vim-athena"
},
{
"binary_version": "2:7.4.1689-3ubuntu1.5+esm35",
"binary_name": "vim-athena-py2"
},
{
"binary_version": "2:7.4.1689-3ubuntu1.5+esm35",
"binary_name": "vim-common"
},
{
"binary_version": "2:7.4.1689-3ubuntu1.5+esm35",
"binary_name": "vim-gnome"
},
{
"binary_version": "2:7.4.1689-3ubuntu1.5+esm35",
"binary_name": "vim-gnome-py2"
},
{
"binary_version": "2:7.4.1689-3ubuntu1.5+esm35",
"binary_name": "vim-gtk"
},
{
"binary_version": "2:7.4.1689-3ubuntu1.5+esm35",
"binary_name": "vim-gtk-py2"
},
{
"binary_version": "2:7.4.1689-3ubuntu1.5+esm35",
"binary_name": "vim-gtk3"
},
{
"binary_version": "2:7.4.1689-3ubuntu1.5+esm35",
"binary_name": "vim-gtk3-py2"
},
{
"binary_version": "2:7.4.1689-3ubuntu1.5+esm35",
"binary_name": "vim-gui-common"
},
{
"binary_version": "2:7.4.1689-3ubuntu1.5+esm35",
"binary_name": "vim-nox"
},
{
"binary_version": "2:7.4.1689-3ubuntu1.5+esm35",
"binary_name": "vim-nox-py2"
},
{
"binary_version": "2:7.4.1689-3ubuntu1.5+esm35",
"binary_name": "vim-runtime"
},
{
"binary_version": "2:7.4.1689-3ubuntu1.5+esm35",
"binary_name": "vim-tiny"
}
]
}{
"binaries": [
{
"binary_version": "2:8.0.1453-1ubuntu1.13+esm20",
"binary_name": "vim"
},
{
"binary_version": "2:8.0.1453-1ubuntu1.13+esm20",
"binary_name": "vim-athena"
},
{
"binary_version": "2:8.0.1453-1ubuntu1.13+esm20",
"binary_name": "vim-common"
},
{
"binary_version": "2:8.0.1453-1ubuntu1.13+esm20",
"binary_name": "vim-gnome"
},
{
"binary_version": "2:8.0.1453-1ubuntu1.13+esm20",
"binary_name": "vim-gtk"
},
{
"binary_version": "2:8.0.1453-1ubuntu1.13+esm20",
"binary_name": "vim-gtk3"
},
{
"binary_version": "2:8.0.1453-1ubuntu1.13+esm20",
"binary_name": "vim-gui-common"
},
{
"binary_version": "2:8.0.1453-1ubuntu1.13+esm20",
"binary_name": "vim-nox"
},
{
"binary_version": "2:8.0.1453-1ubuntu1.13+esm20",
"binary_name": "vim-runtime"
},
{
"binary_version": "2:8.0.1453-1ubuntu1.13+esm20",
"binary_name": "vim-tiny"
},
{
"binary_version": "2:8.0.1453-1ubuntu1.13+esm20",
"binary_name": "xxd"
}
]
}{
"binaries": [
{
"binary_version": "2:8.1.2269-1ubuntu5.32+esm8",
"binary_name": "vim"
},
{
"binary_version": "2:8.1.2269-1ubuntu5.32+esm8",
"binary_name": "vim-athena"
},
{
"binary_version": "2:8.1.2269-1ubuntu5.32+esm8",
"binary_name": "vim-common"
},
{
"binary_version": "2:8.1.2269-1ubuntu5.32+esm8",
"binary_name": "vim-gtk"
},
{
"binary_version": "2:8.1.2269-1ubuntu5.32+esm8",
"binary_name": "vim-gtk3"
},
{
"binary_version": "2:8.1.2269-1ubuntu5.32+esm8",
"binary_name": "vim-gui-common"
},
{
"binary_version": "2:8.1.2269-1ubuntu5.32+esm8",
"binary_name": "vim-nox"
},
{
"binary_version": "2:8.1.2269-1ubuntu5.32+esm8",
"binary_name": "vim-runtime"
},
{
"binary_version": "2:8.1.2269-1ubuntu5.32+esm8",
"binary_name": "vim-tiny"
},
{
"binary_version": "2:8.1.2269-1ubuntu5.32+esm8",
"binary_name": "xxd"
}
]
}