vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.
[
{
"id": "CVE-2017-5953-81fd5156",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "src/spellfile.c",
"function": "spell_read_tree"
},
"source": "https://github.com/vim/vim/commit/399c297aa93afe2c0a39e2a1b3f972aebba44c9d",
"digest": {
"length": 582.0,
"function_hash": "270963623728371117107474029981875322174"
},
"signature_type": "Function"
},
{
"id": "CVE-2017-5953-b356aac5",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "src/spellfile.c"
},
"source": "https://github.com/vim/vim/commit/399c297aa93afe2c0a39e2a1b3f972aebba44c9d",
"digest": {
"line_hashes": [
"92673288073310823043741533162792337542",
"17808163214729196838027593952031201747",
"69718327161397786629207745564951476005",
"292252201400447071467488880313594198920"
],
"threshold": 0.9
},
"signature_type": "Line"
},
{
"id": "CVE-2017-5953-de536671",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "src/version.c"
},
"source": "https://github.com/vim/vim/commit/399c297aa93afe2c0a39e2a1b3f972aebba44c9d",
"digest": {
"line_hashes": [
"146200493773228420153804765641940418619",
"204897543870975188852231448937125890242",
"254252104479503521227150663999463097126",
"140813921799221096148041154944335634523"
],
"threshold": 0.9
},
"signature_type": "Line"
}
]