Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-0433: Vim before 9.0.1225 could be exploited to run code

CVE-2023-0433 · published 3 years ago

Summary

The popular text editor Vim, in versions released before 9.0.1225, contains a flaw that can let a crafted file cause the program to overflow memory. This may result in the editor crashing or an attacker executing unwanted code on the affected computer. Upgrade Vim to version 9.0.1225 or later, or apply any supplied security patches, and verify the update in your environment.

What to do

Update debian vim to version 2:9.0.1378-1.
Update vim to version 9.0.1251-r0.
Update neovim neovim to version 0.8.3 or later.
Update vim vim to version 9.0.1225 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	vim	< 2:9.0.1378-1 Fix: upgrade to 2:9.0.1378-1
Debian:13	debian	vim	< 2:9.0.1378-1 Fix: upgrade to 2:9.0.1378-1
Debian:14	debian	vim	< 2:9.0.1378-1 Fix: upgrade to 2:9.0.1378-1
–	apple	macos	< 11.7.5 >= 12.0.0, < 12.6.4 >= 13.0, < 13.3 `cpe:2.3:o:apple:macos::::::::`
–	fedoraproject	fedora	36 37 `cpe:2.3:o:fedoraproject:fedora:36:::::::*`
–	neovim	neovim	>= 0.1.0, < 0.8.3 `cpe:2.3:a:neovim:neovim::::::::`
–	vim	vim	< 9.0.1225 `cpe:2.3:a:vim:vim::::::::`
Alpine:v3.18	–	vim	< 9.0.1251-r0 Fix: upgrade to 9.0.1251-r0

Original advisory text

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225.

References

https://security-tracker.debian.org/tracker/CVE-2023-0433 Vendor Advisory
https://huntr.dev/bounties/ae933869-a1ec-402a-bbea-d51764c6618e URL
https://support.apple.com/kb/HT213670 URL
https://support.apple.com/kb/HT213675 URL
https://support.apple.com/kb/HT213677 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0433.j... Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-0433 Vendor Advisory
http://seclists.org/fulldisclosure/2023/Mar/17 Third Party Advisory
http://seclists.org/fulldisclosure/2023/Mar/18 Third Party Advisory
http://seclists.org/fulldisclosure/2023/Mar/21 Third Party Advisory
https://github.com/vim/vim/commit/11977f917506d950b7e0cae558bd9189260b253b Patch
https://security.alpinelinux.org/vuln/CVE-2023-0433 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-122Heap-based Buffer Overflow

Timeline

Published21 Jan 2023

Updated4 Nov 2026

First seen1 Sep 2026

Sources

DEBIAN-CVE-2023-0433 · OSV

CVE-2023-0433 · NVD

CVE-2023-0433 · OSV

ALPINE-CVE-2023-0433 · OSV

Track software like this

Free during beta