Log in Start free

Vulnerability · Published Oct 27, 2023 · Assigned by GitHub_M

CVE-2023-46246Integer Overflow in :history command in Vim

Medium 4.0

In plain English

A medium-severity use-after-free in vim from vim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.0Medium
Exploit odds (30 days)0.4%top 67.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the file `src/alloc.c` at line 748, which is freed in the file `src/ex_docmd.c` in the function `do_cmdline` at line 1010 and then used again in `src/cmdhist.c` at line 759. When using the `:history` command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12vimno fix listedDEBIAN-CVE-2023-46246
Debian:13vim2:9.0.2087-1DEBIAN-CVE-2023-46246
Debian:14vim2:9.0.2087-1DEBIAN-CVE-2023-46246
Ubuntu:22.04:LTSvim2:8.2.3995-1ubuntu2.15USN-6557-1
Ubuntu:22.04:LTSvim2:8.2.3995-1ubuntu2.15UBUNTU-CVE-2023-46246

Affected products (as reported)

VendorProductVersions
vim vim <= 9.0.2067

Weakness: CWE-416, CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References