Описание
Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has been patched in version 9.2.0450.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needs-triage | |
| esm-infra-legacy/trusty | released | 2:7.4.052-1ubuntu3.1+esm26 |
| esm-infra-legacy/xenial | released | 2:7.4.1689-3ubuntu1.5+esm32 |
| esm-infra/bionic | released | 2:8.0.1453-1ubuntu1.13+esm17 |
| esm-infra/focal | released | 2:8.1.2269-1ubuntu5.32+esm5 |
| esm-infra/xenial | ignored | end of ESM support, was needs-triage |
| jammy | released | 2:8.2.3995-1ubuntu2.30 |
| noble | released | 2:9.1.0016-1ubuntu7.14 |
| questing | released | 2:9.1.0967-1ubuntu6.5 |
| resolute | released | 2:9.1.2141-1ubuntu4.2 |
Показывать по
Ссылки на источники
6.6 Medium
CVSS3
Связанные уязвимости
Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has been patched in version 9.2.0450.
Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has been patched in version 9.2.0450.
Vim is an open source, command line text editor. Prior to version 9.2. ...
6.6 Medium
CVSS3