Use-after-free in Vim - CVE-2024-41957

Vulnerability identifier: #VU95159

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-41957

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to a use-after-free error within the tagstack_clear_entry() function. A remote attacker can trick the victim to open a specially crafted file with Vim using several non-default flags, trigger a use-after-free error and crash the editor.

Vim
Netezza Appliance
Ubuntu
openEuler
Fedora
macOS
vim (Ubuntu package)
vim
vim-X11
vim-common
vim-debuginfo
vim-debugsource
vim-enhanced
vim-minimal
vim-filesystem

Install updates from vendor's website.

Vim - update to 9.1.0647
Netezza Appliance - update to 1.0.2.3
vim (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2:8.1.2269-1ubuntu5.24, 2:8.2.3995-1ubuntu2.18, 2:9.1.0016-1ubuntu7.2
vim - update to 9.0-24
vim-X11 - update to 9.0-24
vim-common - update to 9.0-24
vim-debuginfo - update to 9.0-24
vim-debugsource - update to 9.0-24
vim-enhanced - update to 9.0-24
vim-minimal - update to 9.0-24
vim-filesystem - update to 9.0-24
vim - addressed in versions 9.1.660-1.fc39, 9.1.660-1.fc40
macOS - update to 15.0 24A335

• https://github.com/vim/vim/security/advisories/GHSA-f9cr-gv85-hcr4
• https://github.com/vim/vim/commit/8a0bbe7b8aad6f8da28dee218c01bc8a0185a

• Denial of service in Vim
• Fedora 40 update for vim
• Fedora 39 update for vim
• openEuler update for vim
• Ubuntu update for vim
• Multiple vulnerabilities in macOS Sequoia
• Multiple vulnerabilities in IBM Netezza Appliance - Callhome