Heap-based buffer overflow in Vim - CVE-2024-43790

Vulnerability identifier: #VU96466

CSH Severity: Low

CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-43790

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to boundary error within the do_search() function when performing a search and displaying the search-count message is disabled. A remote attacker can trick the victim to open a specially crafted file and use a specially crafted payload to search information, trigger a heap-based buffer overflow and crash the editor.

Vim
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Desktop Applications Module
Basesystem Module
openSUSE Leap
SmartFabric Manager
APEX Cloud Platform for Microsoft Azure
APEX Cloud Platform for Red Hat OpenShift
gvim-debuginfo
vim-data
vim
vim-debuginfo
vim-debugsource
gvim
vim-data-common
vim-small-debuginfo
vim-small
xxd

Install update from vendor's website.

Vim - update to 9.1.0689
SmartFabric Manager - update to 1.3.0
APEX Cloud Platform for Microsoft Azure - update to 01.04.01.00
APEX Cloud Platform for Red Hat OpenShift - update to 03.02.04.00
gvim-debuginfo - addressed in versions 9.1.1101-17.41.1, 9.1.1101-150500.20.21.1
vim-data - addressed in versions 9.1.1101-17.41.1, 9.1.1101-150500.20.21.1
vim - addressed in versions 9.1.1101-17.41.1, 9.1.1101-150500.20.21.1
vim-debuginfo - addressed in versions 9.1.1101-17.41.1, 9.1.1101-150000.5.69.1, 9.1.1101-150500.20.21.1
vim-debugsource - addressed in versions 9.1.1101-17.41.1, 9.1.1101-150000.5.69.1, 9.1.1101-150500.20.21.1
gvim - addressed in versions 9.1.1101-17.41.1, 9.1.1101-150500.20.21.1
vim-data-common - addressed in versions 9.1.1101-17.41.1, 9.1.1101-150000.5.69.1, 9.1.1101-150500.20.21.1
vim-small-debuginfo - addressed in versions 9.1.1101-150000.5.69.1, 9.1.1101-150500.20.21.1
vim-small - addressed in versions 9.1.1101-150000.5.69.1, 9.1.1101-150500.20.21.1
xxd - update to 9.1.1101-150000.5.69.1

• https://github.com/vim/vim/security/advisories/GHSA-v2x2-cjcg-f9jm

• Denial of service in Vim
• SUSE update for vim
• SUSE update for vim
• SUSE update for vim
• Dell APEX Cloud Platform for Red Hat OpenShift update for third-party components
• Dell APEX Cloud Platform for Microsoft Azure update for third-party components
• Dell SmartFabric Manager update for third-party components