Описание
Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needs-triage | |
| esm-infra-legacy/trusty | released | 2:7.4.052-1ubuntu3.1+esm30 |
| esm-infra-legacy/xenial | released | 2:7.4.1689-3ubuntu1.5+esm36 |
| esm-infra/bionic | released | 2:8.0.1453-1ubuntu1.13+esm21 |
| esm-infra/focal | released | 2:8.1.2269-1ubuntu5.32+esm9 |
| jammy | released | 2:8.2.3995-1ubuntu2.33 |
| noble | released | 2:9.1.0016-1ubuntu7.17 |
| questing | released | 2:9.1.0967-1ubuntu6.8 |
| resolute | released | 2:9.1.2141-1ubuntu4.6 |
| upstream | not-affected | 9.2.0662 |
Показывать по
5.5 Medium
CVSS3
Связанные уязвимости
Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.
Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (prefix[], arridx[], curi[]). A crafted .spl file, loaded when the user dumps the word list, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0662.
Vim is an open source, command line text editor. Prior to 9.2.0662, th ...
5.5 Medium
CVSS3