Amazon Linux AMI update for vim



Risk High
Patch available YES
Number of vulnerabilities 15
CVE-ID CVE-2022-3234
CVE-2022-3235
CVE-2022-3256
CVE-2022-3278
CVE-2022-3296
CVE-2022-3297
CVE-2022-3324
CVE-2022-3352
CVE-2022-3491
CVE-2022-47024
CVE-2023-0051
CVE-2023-0054
CVE-2023-0288
CVE-2023-0433
CVE-2023-0512
CWE-ID CWE-122
CWE-416
CWE-476
CWE-119
CWE-121
CWE-787
CWE-369
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Amazon Linux AMI
Operating systems & Components / Operating system

vim
Operating systems & Components / Operating system package or component

Vendor Amazon Web Services

Security Bulletin

This security bulletin contains information about 15 vulnerabilities.

1) Heap-based buffer overflow

EUVDB-ID: #VU67435

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-3234

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the utfc_ptr2len() function at mbyte.c. A remote attacker can trick the victim to open a specially crafted fule, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

aarch64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-9.0.1314-1.amzn2023.0.2.aarch64

noarch:
    vim-filesystem-9.0.1314-1.amzn2023.0.2.noarch
    vim-default-editor-9.0.1314-1.amzn2023.0.2.noarch
    vim-data-9.0.1314-1.amzn2023.0.2.noarch

src:
    vim-9.0.1314-1.amzn2023.0.2.src

x86_64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-9.0.1314-1.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: All versions

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-117.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU67625

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-3235

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the getcmdline_int() function in ex_getln.c. A remote attacker can trick the victim to open a specially crafted file, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages:

aarch64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-9.0.1314-1.amzn2023.0.2.aarch64

noarch:
    vim-filesystem-9.0.1314-1.amzn2023.0.2.noarch
    vim-default-editor-9.0.1314-1.amzn2023.0.2.noarch
    vim-data-9.0.1314-1.amzn2023.0.2.noarch

src:
    vim-9.0.1314-1.amzn2023.0.2.src

x86_64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-9.0.1314-1.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: All versions

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-117.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU67627

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-3256

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the movemark() function in mark.c. A remote attacker can trick the victim to open a specially crafted file, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages:

aarch64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-9.0.1314-1.amzn2023.0.2.aarch64

noarch:
    vim-filesystem-9.0.1314-1.amzn2023.0.2.noarch
    vim-default-editor-9.0.1314-1.amzn2023.0.2.noarch
    vim-data-9.0.1314-1.amzn2023.0.2.noarch

src:
    vim-9.0.1314-1.amzn2023.0.2.src

x86_64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-9.0.1314-1.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: All versions

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-117.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) NULL pointer dereference

EUVDB-ID: #VU67626

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-3278

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in eval.c. A remote attacker can perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-9.0.1314-1.amzn2023.0.2.aarch64

noarch:
    vim-filesystem-9.0.1314-1.amzn2023.0.2.noarch
    vim-default-editor-9.0.1314-1.amzn2023.0.2.noarch
    vim-data-9.0.1314-1.amzn2023.0.2.noarch

src:
    vim-9.0.1314-1.amzn2023.0.2.src

x86_64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-9.0.1314-1.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: All versions

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-117.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Buffer overflow

EUVDB-ID: #VU67658

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-3296

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing files within the ex_finally() function in ex_eval.c. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

aarch64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-9.0.1314-1.amzn2023.0.2.aarch64

noarch:
    vim-filesystem-9.0.1314-1.amzn2023.0.2.noarch
    vim-default-editor-9.0.1314-1.amzn2023.0.2.noarch
    vim-data-9.0.1314-1.amzn2023.0.2.noarch

src:
    vim-9.0.1314-1.amzn2023.0.2.src

x86_64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-9.0.1314-1.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: All versions

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-117.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use-after-free

EUVDB-ID: #VU67659

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-3297

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the process_next_cpt_value() function in insexpand.c when processing files. A remote attacker can trick the victim to open a specially crafted flie, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages:

aarch64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-9.0.1314-1.amzn2023.0.2.aarch64

noarch:
    vim-filesystem-9.0.1314-1.amzn2023.0.2.noarch
    vim-default-editor-9.0.1314-1.amzn2023.0.2.noarch
    vim-data-9.0.1314-1.amzn2023.0.2.noarch

src:
    vim-9.0.1314-1.amzn2023.0.2.src

x86_64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-9.0.1314-1.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: All versions

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-117.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Stack-based buffer overflow

EUVDB-ID: #VU68964

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-3324

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when handling files within the win_redr_ruler(0 function in drawscreen.c. A remote attacker can trick the victim to open a specially crafted file, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

aarch64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-9.0.1314-1.amzn2023.0.2.aarch64

noarch:
    vim-filesystem-9.0.1314-1.amzn2023.0.2.noarch
    vim-default-editor-9.0.1314-1.amzn2023.0.2.noarch
    vim-data-9.0.1314-1.amzn2023.0.2.noarch

src:
    vim-9.0.1314-1.amzn2023.0.2.src

x86_64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-9.0.1314-1.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: All versions

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-117.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Use-after-free

EUVDB-ID: #VU68963

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-3352

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when handling files within the did_set_string_option() function in optionstr.c. A remote attacker can trick the victim to open a specially crafted file, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages:

aarch64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-9.0.1314-1.amzn2023.0.2.aarch64

noarch:
    vim-filesystem-9.0.1314-1.amzn2023.0.2.noarch
    vim-default-editor-9.0.1314-1.amzn2023.0.2.noarch
    vim-data-9.0.1314-1.amzn2023.0.2.noarch

src:
    vim-9.0.1314-1.amzn2023.0.2.src

x86_64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-9.0.1314-1.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: All versions

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-117.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Heap-based buffer overflow

EUVDB-ID: #VU70133

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-3491

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the skipwhite() function in charset.c. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

aarch64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-9.0.1314-1.amzn2023.0.2.aarch64

noarch:
    vim-filesystem-9.0.1314-1.amzn2023.0.2.noarch
    vim-default-editor-9.0.1314-1.amzn2023.0.2.noarch
    vim-data-9.0.1314-1.amzn2023.0.2.noarch

src:
    vim-9.0.1314-1.amzn2023.0.2.src

x86_64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-9.0.1314-1.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: All versions

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-117.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) NULL pointer dereference

EUVDB-ID: #VU71559

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-47024

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the gui_x11_create_blank_mouse(0 function in gui_x11.c. A remote attacker can perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

aarch64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-9.0.1314-1.amzn2023.0.2.aarch64

noarch:
    vim-filesystem-9.0.1314-1.amzn2023.0.2.noarch
    vim-default-editor-9.0.1314-1.amzn2023.0.2.noarch
    vim-data-9.0.1314-1.amzn2023.0.2.noarch

src:
    vim-9.0.1314-1.amzn2023.0.2.src

x86_64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-9.0.1314-1.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: All versions

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-117.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Heap-based buffer overflow

EUVDB-ID: #VU70722

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2023-0051

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the msg_puts_printf(0 function in message.c. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

aarch64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-9.0.1314-1.amzn2023.0.2.aarch64

noarch:
    vim-filesystem-9.0.1314-1.amzn2023.0.2.noarch
    vim-default-editor-9.0.1314-1.amzn2023.0.2.noarch
    vim-data-9.0.1314-1.amzn2023.0.2.noarch

src:
    vim-9.0.1314-1.amzn2023.0.2.src

x86_64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-9.0.1314-1.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: All versions

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-117.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Out-of-bounds write

EUVDB-ID: #VU70723

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2023-0054

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input within the do_string_sub() function in eval.c. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Update the affected packages:

aarch64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-9.0.1314-1.amzn2023.0.2.aarch64

noarch:
    vim-filesystem-9.0.1314-1.amzn2023.0.2.noarch
    vim-default-editor-9.0.1314-1.amzn2023.0.2.noarch
    vim-data-9.0.1314-1.amzn2023.0.2.noarch

src:
    vim-9.0.1314-1.amzn2023.0.2.src

x86_64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-9.0.1314-1.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: All versions

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-117.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Heap-based buffer overflow

EUVDB-ID: #VU71560

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2023-0288

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the ml_append_int() function in memline.c. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

aarch64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-9.0.1314-1.amzn2023.0.2.aarch64

noarch:
    vim-filesystem-9.0.1314-1.amzn2023.0.2.noarch
    vim-default-editor-9.0.1314-1.amzn2023.0.2.noarch
    vim-data-9.0.1314-1.amzn2023.0.2.noarch

src:
    vim-9.0.1314-1.amzn2023.0.2.src

x86_64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-9.0.1314-1.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: All versions

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-117.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Heap-based buffer overflow

EUVDB-ID: #VU71558

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2023-0433

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the same_leader() and utfc_ptr2len() function. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

aarch64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-9.0.1314-1.amzn2023.0.2.aarch64

noarch:
    vim-filesystem-9.0.1314-1.amzn2023.0.2.noarch
    vim-default-editor-9.0.1314-1.amzn2023.0.2.noarch
    vim-data-9.0.1314-1.amzn2023.0.2.noarch

src:
    vim-9.0.1314-1.amzn2023.0.2.src

x86_64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-9.0.1314-1.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: All versions

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-117.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Division by zero

EUVDB-ID: #VU72341

Risk: Low

CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-0512

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a divide by zero in the adjust_skipcol() function in move.c. A remote attacker can trick the victim to open a specially crafted file and crash the editor.

Mitigation

Update the affected packages:

aarch64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.aarch64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.aarch64
    vim-minimal-9.0.1314-1.amzn2023.0.2.aarch64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.aarch64
    vim-common-9.0.1314-1.amzn2023.0.2.aarch64

noarch:
    vim-filesystem-9.0.1314-1.amzn2023.0.2.noarch
    vim-default-editor-9.0.1314-1.amzn2023.0.2.noarch
    vim-data-9.0.1314-1.amzn2023.0.2.noarch

src:
    vim-9.0.1314-1.amzn2023.0.2.src

x86_64:
    vim-enhanced-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-enhanced-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-debuginfo-9.0.1314-1.amzn2023.0.2.x86_64
    vim-minimal-9.0.1314-1.amzn2023.0.2.x86_64
    vim-debugsource-9.0.1314-1.amzn2023.0.2.x86_64
    vim-common-9.0.1314-1.amzn2023.0.2.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

vim: All versions

CPE2.3 External links

https://alas.aws.amazon.com/AL2023/ALAS-2023-117.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###