Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2023-4752: Debian vim may execute code after memory misuse
CVE-2023-4752 · published 3 years ago
Summary
The version of vim included in Debian before 9.0.1858 incorrectly reuses memory that has already been released. This can allow an attacker to make the editor run unwanted code or cause it to stop working. Upgrade vim to the latest version or apply the Debian security update to fix the issue.
What to do
- Update debian vim to version 2:9.0.1378-2+deb12u1.
- Update debian vim to version 2:9.0.1894-1.
- Update vim to version 9.0.2073-r0.
- Update vim to version 9.0.1888-r0.
- Update neovim neovim to version 0.10.0 or later.
- Update vim vim to version 9.0.1858 or later.
- Update apple macos to version 14.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | neovim | neovim |
>= 0.5.0, < 0.10.0 cpe:2.3:a:neovim:neovim:*:*:*:*:*:*:*:* |
| – | vim | vim |
< 9.0.1858 cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
37 38 39 cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* |
| – | debian | debian_linux |
10.0 11.0 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| – | apple | macos |
< 14.1 cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
| Debian:12 | debian | vim |
< 2:9.0.1378-2+deb12u1 Fix: upgrade to 2:9.0.1378-2+deb12u1
|
| Debian:13 | debian | vim |
< 2:9.0.1894-1 Fix: upgrade to 2:9.0.1894-1
|
| Alpine:v3.18 | – | vim |
< 9.0.2073-r0 Fix: upgrade to 9.0.2073-r0
|
| Alpine:v3.19 | – | vim |
< 9.0.1888-r0 Fix: upgrade to 9.0.1888-r0
|
Original advisory text
Use After Free in vim/vim
Use After Free in GitHub repository vim/vim prior to 9.0.1858.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4752.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-4752 Vendor Advisory
- https://github.com/vim/vim/commit/ee9166eb3b41846661a39b662dc7ebe8b5e15139 Patch
- https://security-tracker.debian.org/tracker/CVE-2023-4752 Vendor Advisory
- https://support.apple.com/kb/HT213984 URL
- https://lists.fedoraproject.org/archives/list/[email protected]... URL
- https://lists.fedoraproject.org/archives/list/[email protected]... URL
- http://seclists.org/fulldisclosure/2023/Oct/24 URL
- https://huntr.dev/bounties/85f62dd7-ed84-4fa2-b265-8a369a318757 URL
- https://lists.debian.org/debian-lts-announce/2023/09/msg00035.html URL
- https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html URL
- https://lists.fedoraproject.org/archives/list/[email protected]... URL
- https://security.alpinelinux.org/vuln/CVE-2023-4752 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-416Use After Free
Timeline
Published4 Sep 2023
Updated4 Nov 2026
First seen12 Apr 2026
Sources
CVE-2023-4752 · OSV
CVE-2023-4752 · NVD
DEBIAN-CVE-2023-4752 · OSV
ALPINE-CVE-2023-4752 · OSV
Track software like this
Free during beta