Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function ga_grow_inner in in the file src/alloc.c at line 748, which is freed in the file src/ex_docmd.c in the function do_cmdline at line 1010 and then used again in src/cmdhist.c at line 759. When using the :history command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068.
{
"cwe_ids": [
"CWE-190",
"CWE-416"
]
}[
{
"digest": {
"length": 2008.0,
"function_hash": "144888333369104662860959826844435234553"
},
"signature_type": "Function",
"target": {
"function": "ex_history",
"file": "src/cmdhist.c"
},
"deprecated": false,
"source": "https://github.com/vim/vim/commit/9198c1f2b1ddecde22af918541e0de2a32f0f45a",
"signature_version": "v1",
"id": "CVE-2023-46246-0525138d"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"83810544288370710240332115471533442725",
"276613477933502006216551321096295194795",
"281913860824131759085120832804395420630",
"211949061071373328735544434733415598376",
"200086307439970253131483083417162404304",
"80616765400036183077121288335630262391",
"106315423487899612916284866425145473689",
"18505477631081179121518445040418688743",
"158827967879324869035509669112778082484"
]
},
"signature_type": "Line",
"target": {
"file": "src/ex_getln.c"
},
"deprecated": false,
"source": "https://github.com/vim/vim/commit/9198c1f2b1ddecde22af918541e0de2a32f0f45a",
"signature_version": "v1",
"id": "CVE-2023-46246-1625ecae"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"250853904718747674178231832274007555607",
"95867614051154348205749068921981109297",
"57254170699622514462336208979380459890",
"327652504315796048666594084104772656910"
]
},
"signature_type": "Line",
"target": {
"file": "src/cmdhist.c"
},
"deprecated": false,
"source": "https://github.com/vim/vim/commit/9198c1f2b1ddecde22af918541e0de2a32f0f45a",
"signature_version": "v1",
"id": "CVE-2023-46246-2f2a4e19"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"146200493773228420153804765641940418619",
"313284501507916344264128728252187429571",
"212053614812808916596103159083288652263",
"39117405631307745979650808059652815445"
]
},
"signature_type": "Line",
"target": {
"file": "src/version.c"
},
"deprecated": false,
"source": "https://github.com/vim/vim/commit/9198c1f2b1ddecde22af918541e0de2a32f0f45a",
"signature_version": "v1",
"id": "CVE-2023-46246-b4e53c23"
},
{
"digest": {
"length": 671.0,
"function_hash": "68193474878718813215576228891256339946"
},
"signature_type": "Function",
"target": {
"function": "get_list_range",
"file": "src/ex_getln.c"
},
"deprecated": false,
"source": "https://github.com/vim/vim/commit/9198c1f2b1ddecde22af918541e0de2a32f0f45a",
"signature_version": "v1",
"id": "CVE-2023-46246-b9f8cdae"
}
]