Untrusted search path in Vim - CVE-2023-4736

Vulnerability identifier: #VU80227

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-4736

CWE-ID: CWE-426

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of an untrusted search path when searching for perl, zig, ruby filetype plugins as well as zip and gzip autoload plugins. A remote attacker can trick the victim into downloading specially crafted files and opening one of the downloaded files using the affected software.

Successful exploitation of the vulnerability may lead to remote code execution.

Vim
macOS
openEuler
Anolis OS
Oracle Solaris
vim
vim-debuginfo
vim-enhanced
vim-X11
vim-common
vim-debugsource
vim-minimal
vim-filesystem
vim-doc
vim-data

Install updates from vendor's website.

Vim - update to 9.0.1833
macOS - update to 14.1 23B74
vim - update to 9.0-16
vim-debuginfo - update to 9.0-16
vim-enhanced - update to 9.0-16
vim-X11 - update to 9.0-16
vim-common - update to 9.0-16
vim-debugsource - update to 9.0-16
vim-minimal - update to 9.0-16
vim-filesystem - update to 9.0-16
vim-filesystem - update to 9.0.2026-1
vim-doc - update to 9.0.2026-1
vim-data - update to 9.0.2026-1
vim-minimal - update to 9.0.2026-1
vim-enhanced - update to 9.0.2026-1
vim-common - update to 9.0.2026-1
vim-X11 - update to 9.0.2026-1
Oracle Solaris - update to 11.4 SRU 65

• https://github.com/vim/vim/releases/tag/v9.0.1833

• Untrusted search path in Vim
• Multiple vulnerabilities in Apple macOS Sonoma
• Oracle Solaris update for thrid-party components
• openEuler update for vim
• Anolis OS update for vim