Vulnerability · Published Oct 2, 2023 · Assigned by @huntrdev

CVE-2023-5344Heap-based Buffer Overflow in vim/vim

Medium 4.0

In plain English

A medium-severity heap buffer overflow in vim/vim from vim. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)4.0Medium

Exploit odds (30 days)1.3%top 30.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1969.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.20	vim	9.0.1994-r0	ALPINE-CVE-2023-5344
Alpine:v3.21	vim	9.0.1994-r0	ALPINE-CVE-2023-5344
Alpine:v3.22	vim	9.0.1994-r0	ALPINE-CVE-2023-5344
Alpine:v3.23	vim	9.0.1994-r0	ALPINE-CVE-2023-5344
Alpine:v3.24	vim	9.0.1994-r0	ALPINE-CVE-2023-5344
Debian:12	vim	2:9.0.1378-2+deb12u1	DEBIAN-CVE-2023-5344
Debian:13	vim	2:9.0.2018-1	DEBIAN-CVE-2023-5344
Debian:14	vim	2:9.0.2018-1	DEBIAN-CVE-2023-5344
Ubuntu:22.04:LTS	vim	2:8.2.3995-1ubuntu2.13	UBUNTU-CVE-2023-5344
Ubuntu:22.04:LTS	vim	2:8.2.3995-1ubuntu2.13	USN-6452-1

Affected products (as reported)

Vendor	Product	Versions
vim	vim/vim	unspecified – before 9.0.1969

Weakness: CWE-122 · Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References