Amazon Linux AMI update for vim



Published: 2023-04-06
Risk High
Patch available YES
Number of vulnerabilities 15
CVE-ID CVE-2022-2522
CVE-2022-2849
CVE-2022-2862
CVE-2022-2982
CVE-2022-3016
CVE-2022-3256
CVE-2022-3324
CVE-2022-3491
CVE-2022-47024
CVE-2023-0051
CVE-2023-0054
CVE-2023-1170
CVE-2023-1175
CVE-2023-1264
CVE-2023-1355
CWE-ID CWE-122
CWE-416
CWE-121
CWE-476
CWE-787
CWE-119
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		Amazon Linux AMI
Operating systems & Components / Operating system

vim
Operating systems & Components / Operating system package or component

Vendor Amazon Web Services

Security Bulletin

This security bulletin contains information about 15 vulnerabilities.

1) Heap-based buffer overflow

EUVDB-ID: #VU66637

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-2522

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the ins_compl_infercase_gettext() function in insexpand.c. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

i686:
    vim-common-9.0.1403-1.76.amzn1.i686
    vim-enhanced-9.0.1403-1.76.amzn1.i686
    vim-minimal-9.0.1403-1.76.amzn1.i686
    vim-debuginfo-9.0.1403-1.76.amzn1.i686

noarch:
    vim-filesystem-9.0.1403-1.76.amzn1.noarch
    vim-data-9.0.1403-1.76.amzn1.noarch

src:
    vim-9.0.1403-1.76.amzn1.src

x86_64:
    vim-enhanced-9.0.1403-1.76.amzn1.x86_64
    vim-minimal-9.0.1403-1.76.amzn1.x86_64
    vim-common-9.0.1403-1.76.amzn1.x86_64
    vim-debuginfo-9.0.1403-1.76.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: before 9.0.1403-1.76

External links

http://alas.aws.amazon.com/ALAS-2023-1716.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Heap-based buffer overflow

EUVDB-ID: #VU66631

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-2849

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in mbyte.c. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

i686:
    vim-common-9.0.1403-1.76.amzn1.i686
    vim-enhanced-9.0.1403-1.76.amzn1.i686
    vim-minimal-9.0.1403-1.76.amzn1.i686
    vim-debuginfo-9.0.1403-1.76.amzn1.i686

noarch:
    vim-filesystem-9.0.1403-1.76.amzn1.noarch
    vim-data-9.0.1403-1.76.amzn1.noarch

src:
    vim-9.0.1403-1.76.amzn1.src

x86_64:
    vim-enhanced-9.0.1403-1.76.amzn1.x86_64
    vim-minimal-9.0.1403-1.76.amzn1.x86_64
    vim-common-9.0.1403-1.76.amzn1.x86_64
    vim-debuginfo-9.0.1403-1.76.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: before 9.0.1403-1.76

External links

http://alas.aws.amazon.com/ALAS-2023-1716.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU66630

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-2862

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in vim9compile.c. A remote attacker can trick the victim to open a specially crafted file, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages:

i686:
    vim-common-9.0.1403-1.76.amzn1.i686
    vim-enhanced-9.0.1403-1.76.amzn1.i686
    vim-minimal-9.0.1403-1.76.amzn1.i686
    vim-debuginfo-9.0.1403-1.76.amzn1.i686

noarch:
    vim-filesystem-9.0.1403-1.76.amzn1.noarch
    vim-data-9.0.1403-1.76.amzn1.noarch

src:
    vim-9.0.1403-1.76.amzn1.src

x86_64:
    vim-enhanced-9.0.1403-1.76.amzn1.x86_64
    vim-minimal-9.0.1403-1.76.amzn1.x86_64
    vim-common-9.0.1403-1.76.amzn1.x86_64
    vim-debuginfo-9.0.1403-1.76.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: before 9.0.1403-1.76

External links

http://alas.aws.amazon.com/ALAS-2023-1716.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use-after-free

EUVDB-ID: #VU66787

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-2982

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the qf_fill_buffer() function in quickfix.c. A remote attacker can trick the victim to open a specially crafted file, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages:

i686:
    vim-common-9.0.1403-1.76.amzn1.i686
    vim-enhanced-9.0.1403-1.76.amzn1.i686
    vim-minimal-9.0.1403-1.76.amzn1.i686
    vim-debuginfo-9.0.1403-1.76.amzn1.i686

noarch:
    vim-filesystem-9.0.1403-1.76.amzn1.noarch
    vim-data-9.0.1403-1.76.amzn1.noarch

src:
    vim-9.0.1403-1.76.amzn1.src

x86_64:
    vim-enhanced-9.0.1403-1.76.amzn1.x86_64
    vim-minimal-9.0.1403-1.76.amzn1.x86_64
    vim-common-9.0.1403-1.76.amzn1.x86_64
    vim-debuginfo-9.0.1403-1.76.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: before 9.0.1403-1.76

External links

http://alas.aws.amazon.com/ALAS-2023-1716.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use-after-free

EUVDB-ID: #VU66860

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3016

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the get_next_valid_entry() function in quickfix.c. A remote attacker can trick the victim to open a specially crafted file, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages:

i686:
    vim-common-9.0.1403-1.76.amzn1.i686
    vim-enhanced-9.0.1403-1.76.amzn1.i686
    vim-minimal-9.0.1403-1.76.amzn1.i686
    vim-debuginfo-9.0.1403-1.76.amzn1.i686

noarch:
    vim-filesystem-9.0.1403-1.76.amzn1.noarch
    vim-data-9.0.1403-1.76.amzn1.noarch

src:
    vim-9.0.1403-1.76.amzn1.src

x86_64:
    vim-enhanced-9.0.1403-1.76.amzn1.x86_64
    vim-minimal-9.0.1403-1.76.amzn1.x86_64
    vim-common-9.0.1403-1.76.amzn1.x86_64
    vim-debuginfo-9.0.1403-1.76.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: before 9.0.1403-1.76

External links

http://alas.aws.amazon.com/ALAS-2023-1716.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use-after-free

EUVDB-ID: #VU67627

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3256

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the movemark() function in mark.c. A remote attacker can trick the victim to open a specially crafted file, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages:

i686:
    vim-common-9.0.1403-1.76.amzn1.i686
    vim-enhanced-9.0.1403-1.76.amzn1.i686
    vim-minimal-9.0.1403-1.76.amzn1.i686
    vim-debuginfo-9.0.1403-1.76.amzn1.i686

noarch:
    vim-filesystem-9.0.1403-1.76.amzn1.noarch
    vim-data-9.0.1403-1.76.amzn1.noarch

src:
    vim-9.0.1403-1.76.amzn1.src

x86_64:
    vim-enhanced-9.0.1403-1.76.amzn1.x86_64
    vim-minimal-9.0.1403-1.76.amzn1.x86_64
    vim-common-9.0.1403-1.76.amzn1.x86_64
    vim-debuginfo-9.0.1403-1.76.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: before 9.0.1403-1.76

External links

http://alas.aws.amazon.com/ALAS-2023-1716.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Stack-based buffer overflow

EUVDB-ID: #VU68964

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3324

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when handling files within the win_redr_ruler(0 function in drawscreen.c. A remote attacker can trick the victim to open a specially crafted file, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

i686:
    vim-common-9.0.1403-1.76.amzn1.i686
    vim-enhanced-9.0.1403-1.76.amzn1.i686
    vim-minimal-9.0.1403-1.76.amzn1.i686
    vim-debuginfo-9.0.1403-1.76.amzn1.i686

noarch:
    vim-filesystem-9.0.1403-1.76.amzn1.noarch
    vim-data-9.0.1403-1.76.amzn1.noarch

src:
    vim-9.0.1403-1.76.amzn1.src

x86_64:
    vim-enhanced-9.0.1403-1.76.amzn1.x86_64
    vim-minimal-9.0.1403-1.76.amzn1.x86_64
    vim-common-9.0.1403-1.76.amzn1.x86_64
    vim-debuginfo-9.0.1403-1.76.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: before 9.0.1403-1.76

External links

http://alas.aws.amazon.com/ALAS-2023-1716.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Heap-based buffer overflow

EUVDB-ID: #VU70133

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3491

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the skipwhite() function in charset.c. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

i686:
    vim-common-9.0.1403-1.76.amzn1.i686
    vim-enhanced-9.0.1403-1.76.amzn1.i686
    vim-minimal-9.0.1403-1.76.amzn1.i686
    vim-debuginfo-9.0.1403-1.76.amzn1.i686

noarch:
    vim-filesystem-9.0.1403-1.76.amzn1.noarch
    vim-data-9.0.1403-1.76.amzn1.noarch

src:
    vim-9.0.1403-1.76.amzn1.src

x86_64:
    vim-enhanced-9.0.1403-1.76.amzn1.x86_64
    vim-minimal-9.0.1403-1.76.amzn1.x86_64
    vim-common-9.0.1403-1.76.amzn1.x86_64
    vim-debuginfo-9.0.1403-1.76.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: before 9.0.1403-1.76

External links

http://alas.aws.amazon.com/ALAS-2023-1716.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) NULL pointer dereference

EUVDB-ID: #VU71559

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-47024

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the gui_x11_create_blank_mouse(0 function in gui_x11.c. A remote attacker can perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    vim-common-9.0.1403-1.76.amzn1.i686
    vim-enhanced-9.0.1403-1.76.amzn1.i686
    vim-minimal-9.0.1403-1.76.amzn1.i686
    vim-debuginfo-9.0.1403-1.76.amzn1.i686

noarch:
    vim-filesystem-9.0.1403-1.76.amzn1.noarch
    vim-data-9.0.1403-1.76.amzn1.noarch

src:
    vim-9.0.1403-1.76.amzn1.src

x86_64:
    vim-enhanced-9.0.1403-1.76.amzn1.x86_64
    vim-minimal-9.0.1403-1.76.amzn1.x86_64
    vim-common-9.0.1403-1.76.amzn1.x86_64
    vim-debuginfo-9.0.1403-1.76.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: before 9.0.1403-1.76

External links

http://alas.aws.amazon.com/ALAS-2023-1716.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Heap-based buffer overflow

EUVDB-ID: #VU70722

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0051

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the msg_puts_printf(0 function in message.c. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

i686:
    vim-common-9.0.1403-1.76.amzn1.i686
    vim-enhanced-9.0.1403-1.76.amzn1.i686
    vim-minimal-9.0.1403-1.76.amzn1.i686
    vim-debuginfo-9.0.1403-1.76.amzn1.i686

noarch:
    vim-filesystem-9.0.1403-1.76.amzn1.noarch
    vim-data-9.0.1403-1.76.amzn1.noarch

src:
    vim-9.0.1403-1.76.amzn1.src

x86_64:
    vim-enhanced-9.0.1403-1.76.amzn1.x86_64
    vim-minimal-9.0.1403-1.76.amzn1.x86_64
    vim-common-9.0.1403-1.76.amzn1.x86_64
    vim-debuginfo-9.0.1403-1.76.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: before 9.0.1403-1.76

External links

http://alas.aws.amazon.com/ALAS-2023-1716.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Out-of-bounds write

EUVDB-ID: #VU70723

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0054

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input within the do_string_sub() function in eval.c. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Update the affected packages:

i686:
    vim-common-9.0.1403-1.76.amzn1.i686
    vim-enhanced-9.0.1403-1.76.amzn1.i686
    vim-minimal-9.0.1403-1.76.amzn1.i686
    vim-debuginfo-9.0.1403-1.76.amzn1.i686

noarch:
    vim-filesystem-9.0.1403-1.76.amzn1.noarch
    vim-data-9.0.1403-1.76.amzn1.noarch

src:
    vim-9.0.1403-1.76.amzn1.src

x86_64:
    vim-enhanced-9.0.1403-1.76.amzn1.x86_64
    vim-minimal-9.0.1403-1.76.amzn1.x86_64
    vim-common-9.0.1403-1.76.amzn1.x86_64
    vim-debuginfo-9.0.1403-1.76.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: before 9.0.1403-1.76

External links

http://alas.aws.amazon.com/ALAS-2023-1716.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Heap-based buffer overflow

EUVDB-ID: #VU73170

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-1170

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the utf_ptr2char() function in mbyte.c. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

i686:
    vim-common-9.0.1403-1.76.amzn1.i686
    vim-enhanced-9.0.1403-1.76.amzn1.i686
    vim-minimal-9.0.1403-1.76.amzn1.i686
    vim-debuginfo-9.0.1403-1.76.amzn1.i686

noarch:
    vim-filesystem-9.0.1403-1.76.amzn1.noarch
    vim-data-9.0.1403-1.76.amzn1.noarch

src:
    vim-9.0.1403-1.76.amzn1.src

x86_64:
    vim-enhanced-9.0.1403-1.76.amzn1.x86_64
    vim-minimal-9.0.1403-1.76.amzn1.x86_64
    vim-common-9.0.1403-1.76.amzn1.x86_64
    vim-debuginfo-9.0.1403-1.76.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: before 9.0.1403-1.76

External links

http://alas.aws.amazon.com/ALAS-2023-1716.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Buffer overflow

EUVDB-ID: #VU73171

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-1175

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the yank_copy_line() function in register.c. A remote attacker can create a specially crafted, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

i686:
    vim-common-9.0.1403-1.76.amzn1.i686
    vim-enhanced-9.0.1403-1.76.amzn1.i686
    vim-minimal-9.0.1403-1.76.amzn1.i686
    vim-debuginfo-9.0.1403-1.76.amzn1.i686

noarch:
    vim-filesystem-9.0.1403-1.76.amzn1.noarch
    vim-data-9.0.1403-1.76.amzn1.noarch

src:
    vim-9.0.1403-1.76.amzn1.src

x86_64:
    vim-enhanced-9.0.1403-1.76.amzn1.x86_64
    vim-minimal-9.0.1403-1.76.amzn1.x86_64
    vim-common-9.0.1403-1.76.amzn1.x86_64
    vim-debuginfo-9.0.1403-1.76.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: before 9.0.1403-1.76

External links

http://alas.aws.amazon.com/ALAS-2023-1716.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) NULL pointer dereference

EUVDB-ID: #VU73172

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-1264

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the utfc_ptr2len() function in mbyte.c.c. A remote attacker can trick the victim to open a specially crafted file and crash the editor.

Mitigation

Update the affected packages:

i686:
    vim-common-9.0.1403-1.76.amzn1.i686
    vim-enhanced-9.0.1403-1.76.amzn1.i686
    vim-minimal-9.0.1403-1.76.amzn1.i686
    vim-debuginfo-9.0.1403-1.76.amzn1.i686

noarch:
    vim-filesystem-9.0.1403-1.76.amzn1.noarch
    vim-data-9.0.1403-1.76.amzn1.noarch

src:
    vim-9.0.1403-1.76.amzn1.src

x86_64:
    vim-enhanced-9.0.1403-1.76.amzn1.x86_64
    vim-minimal-9.0.1403-1.76.amzn1.x86_64
    vim-common-9.0.1403-1.76.amzn1.x86_64
    vim-debuginfo-9.0.1403-1.76.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: before 9.0.1403-1.76

External links

http://alas.aws.amazon.com/ALAS-2023-1716.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) NULL pointer dereference

EUVDB-ID: #VU74499

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-1355

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in within the class_object_index() function in vim9class.c in Vim. A remote attacker can perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    vim-common-9.0.1403-1.76.amzn1.i686
    vim-enhanced-9.0.1403-1.76.amzn1.i686
    vim-minimal-9.0.1403-1.76.amzn1.i686
    vim-debuginfo-9.0.1403-1.76.amzn1.i686

noarch:
    vim-filesystem-9.0.1403-1.76.amzn1.noarch
    vim-data-9.0.1403-1.76.amzn1.noarch

src:
    vim-9.0.1403-1.76.amzn1.src

x86_64:
    vim-enhanced-9.0.1403-1.76.amzn1.x86_64
    vim-minimal-9.0.1403-1.76.amzn1.x86_64
    vim-common-9.0.1403-1.76.amzn1.x86_64
    vim-debuginfo-9.0.1403-1.76.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: before 9.0.1403-1.76

External links

http://alas.aws.amazon.com/ALAS-2023-1716.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###