Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Vim on Ubuntu may crash or be compromised
published 3 years ago
Summary
The Vim editor included in Ubuntu 22.04 LTS, 22.10 and 23.04 can mishandle memory, allowing it to crash or potentially run unwanted code. This happens during fuzzy searching, handling registers, or processing substitution strings. Update Vim to the latest package from Ubuntu’s security repository to apply the fixes.
What to do
- Update canonical vim to version 2:7.4.052-1ubuntu3.1+esm10.
- Update canonical vim to version 2:7.4.1689-3ubuntu1.5+esm18.
- Update canonical vim to version 2:8.0.1453-1ubuntu1.13+esm1.
- Update canonical vim to version 2:8.1.2269-1ubuntu5.15.
- Update canonical vim to version 2:8.2.3995-1ubuntu2.8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:14.04:LTS | canonical | vim |
< 2:7.4.052-1ubuntu3.1+esm10 Fix: upgrade to 2:7.4.052-1ubuntu3.1+esm10
|
| Ubuntu:Pro:16.04:LTS | canonical | vim |
< 2:7.4.1689-3ubuntu1.5+esm18 Fix: upgrade to 2:7.4.1689-3ubuntu1.5+esm18
|
| Ubuntu:Pro:18.04:LTS | canonical | vim |
< 2:8.0.1453-1ubuntu1.13+esm1 Fix: upgrade to 2:8.0.1453-1ubuntu1.13+esm1
|
| Ubuntu:20.04:LTS | canonical | vim |
< 2:8.1.2269-1ubuntu5.15 Fix: upgrade to 2:8.1.2269-1ubuntu5.15
|
| Ubuntu:22.04:LTS | canonical | vim |
< 2:8.2.3995-1ubuntu2.8 Fix: upgrade to 2:8.2.3995-1ubuntu2.8
|
Original advisory text
vim vulnerabilities
It was discovered that Vim was using uninitialized memory when fuzzy
matching, which could lead to invalid memory access. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 22.10 and Ubuntu
23.04. (CVE-2023-2426)
It was discovered that Vim was not properly performing bounds checks when
processing register contents, which could lead to a NULL pointer
dereference. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. (CVE-2023-2609)
It was discovered that Vim was not properly limiting the length of
substitution expression strings, which could lead to excessive memory
consumption. An attacker could possibly use this issue to cause a denial
of service. (CVE-2023-2610)
matching, which could lead to invalid memory access. An attacker could
possibly use this issue to cause a denial of service or execute arbitrary
code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 22.10 and Ubuntu
23.04. (CVE-2023-2426)
It was discovered that Vim was not properly performing bounds checks when
processing register contents, which could lead to a NULL pointer
dereference. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. (CVE-2023-2609)
It was discovered that Vim was not properly limiting the length of
substitution expression strings, which could lead to excessive memory
consumption. An attacker could possibly use this issue to cause a denial
of service. (CVE-2023-2610)
References
- https://ubuntu.com/security/notices/USN-6154-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2023-2426 Third Party Advisory
- https://ubuntu.com/security/CVE-2023-2609 Third Party Advisory
- https://ubuntu.com/security/CVE-2023-2610 Third Party Advisory
Timeline
Published12 Jun 2023
Updated25 Sep 2026
First seen25 Sep 2026
Sources
USN-6154-1 · OSV
Track software like this
Free during beta