Heap-based buffer overflow in Vim - CVE-2023-4751

Vulnerability identifier: #VU81488

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-4751

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the utfc_ptr2len() function in mbyte.c. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Vim
Amazon Linux AMI
macOS
Ubuntu
Isolation Segment
VMware Tanzu Application Service for VMs
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Redis for Pivotal Platform
vim-gtk3 (Ubuntu package)
xxd (Ubuntu package)
vim-tiny (Ubuntu package)
vim-nox (Ubuntu package)
vim-gtk (Ubuntu package)
vim-athena (Ubuntu package)
vim (Ubuntu package)
vim
VMware Tanzu Operations Manager

Install updates from vendor's website.

Vim - update to 9.0.1331
macOS - update to 14.1 23B74
vim-gtk3 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2:8.1.2269-1ubuntu5.20, 2:8.2.3995-1ubuntu2.13, 2:9.0.1000-4ubuntu3.2, 2:9.0.1672-1ubuntu2.1
xxd (Ubuntu package) - addressed in versions Ubuntu Pro, 2:8.1.2269-1ubuntu5.20, 2:8.2.3995-1ubuntu2.13, 2:9.0.1000-4ubuntu3.2, 2:9.0.1672-1ubuntu2.1
vim-tiny (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2:8.1.2269-1ubuntu5.20, 2:8.2.3995-1ubuntu2.13, 2:9.0.1000-4ubuntu3.2, 2:9.0.1672-1ubuntu2.1
vim-nox (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2:8.1.2269-1ubuntu5.20, 2:8.2.3995-1ubuntu2.13, 2:9.0.1000-4ubuntu3.2, 2:9.0.1672-1ubuntu2.1
vim-gtk (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2:8.1.2269-1ubuntu5.20, 2:8.2.3995-1ubuntu2.13
vim-athena (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2:8.1.2269-1ubuntu5.20, 2:8.2.3995-1ubuntu2.13, 2:9.0.1000-4ubuntu3.2, 2:9.0.1672-1ubuntu2.1
vim (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2:8.1.2269-1ubuntu5.20, 2:8.2.3995-1ubuntu2.13, 2:9.0.1000-4ubuntu3.2, 2:9.0.1672-1ubuntu2.1
VMware Tanzu Operations Manager - addressed in versions 2.10.66, 3.0.19
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.0.1
vim - addressed in versions 9.0.1712-1.82, 9.0.1882-1

• https://huntr.dev/bounties/db7be8d6-6cb7-4ae5-9c4e-805423afa378
• https://github.com/vim/vim/commit/e1121b139480f53d1b06f84f3e4574048108fa0b

• Remote code execution in Vim
• Amazon Linux AMI update for vim
• Ubuntu update for vim
• Multiple vulnerabilities in Apple macOS Sonoma
• VMware Tanzu products update for Vim
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Amazon Linux AMI update for vim