Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a :s
command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive :s
call causes free-ing of memory which may later then be accessed by the initial :s
command. The user must intentionally execute the payload and the whole process is a bit tricky to do since it seems to work only reliably for the very first :s command. It may also cause a crash of Vim. Version 9.0.2121 contains a fix for this issue.
{ "vanir_signatures": [ { "signature_type": "Line", "deprecated": false, "signature_version": "v1", "digest": { "line_hashes": [ "58972704091159608642833753396070366932", "265850537485380442658363201460516660274", "172008570766993647937329477379985513966", "215752843720206495008455949962361183446", "201000829099694697789778474396198371025", "149203649584607372282427671540238369904", "96266888488630966991536523415806827285", "305501921626624863424560827224034058078", "260086702040576943349751567378347889084", "20687885217496941236750035624672408787", "234556526869346910766273881765229769247", "327411306546362609218980886631251790599", "249253005322399418382713021650695699341", "219255933481483413005227924227368619020", "19954974111493840596731715576398700072", "3034353505767516185615337243679419955", "240219872505484471540660904813796308110", "329730252589971934334194216705535444762", "289929200825211789374489587384513783467", "246837499140795187580707939014736972710", "316963281680792377914030933654081044336", "104062290674162826969789655610154076516", "79979787224105835352372781377143531765", "12729185144437598924608755626458188713", "302378801626181361875359805629154419709", "335895873702380946640357848230555277377", "203083285227504279963168472058091792756", "141677817966021808951887331227910362076", "294178628187064523529355927836133492592", "84670822940795060787979781455149294169", "317989582218652270429642791333797940855", "125984270306141789811234985980387422541", "169648684154511597729358328888476172892", "317230886938872067969691595847770451635", "213626224607275058411826184613966037636", "330886393471490370780998614043183245938", "298678913763746925850149558652223098086", "260367956145206506918504622016312875353", "213649277785249102375811082651234933024", "305469662498605256573083359316147152856", "52838678884215330133998923253082650289", "101478793907769749555101289751796619207", "126564026313305339106920109261148433928", "181662525919248788419080493795637925584", "183475853010225488349829435644110006586", "168775681825917810476266779569752899197", "42231153613554962872178028935800354800", "299401889592436893755086054066272085733", "137989605422665250121861288831393408735", "204228813833459910786977882838919492241", "256270708863361571810719309013023474551", "158690188353756834878963830233101422768", "247471190952908054811788263680672268237", "265067571323441096981189592190079865833", "157814535575328560059626170466836046752", "318587491446350728225934590563864406538", "52416987823816767988336821359069352709", "271856278347952513265848851558482136543", "154761988210357361457074702634568671062", "40793725584169129458575132492116187288", "147665714538127281742281095340492550785", "256157635673107849070871498164965105246", "197389854697531196430769858992005983641", "157017816085259364318915844069763505621", "187422187103794871934145182331189199594", "196321823619300697076949100804610512892", "262537420136556363305403942860093097457", "312734638855880420575966981282490739163", "310546431187206410783444702616607775010", "327866332966880843790052753761940190425", "319696829073653965335696596751913432786", "94241372371818567815639811954509238403", "23408658823875339822907151894046749299", "184097104982000931581212321087265673150", "192125813827388322658767904200466834254", "253887001093730750779088769875750534343", "33273382789511236109233794281574895527", "122567241867223055112860915509162063171", "28379518015818847442047924650077858474", "188651504172615873649040463946999744450", "85637065042933334765314835891997371785", "66391544943026151718550856539704783677", "154102045554386368104502201970650297234" ], "threshold": 0.9 }, "id": "CVE-2023-48706-03c66c8b", "source": "https://github.com/vim/vim/commit/26c11c56888d01e298cd8044caf860f3c26f57bb", "target": { "file": "src/ex_cmds.c" } }, { "signature_type": "Function", "deprecated": false, "signature_version": "v1", "digest": { "function_hash": "126862315985033391345350900798057679151", "length": 16658.0 }, "id": "CVE-2023-48706-6b720c6a", "source": "https://github.com/vim/vim/commit/26c11c56888d01e298cd8044caf860f3c26f57bb", "target": { "file": "src/ex_cmds.c", "function": "ex_substitute" } }, { "signature_type": "Line", "deprecated": false, "signature_version": "v1", "digest": { "line_hashes": [ "146200493773228420153804765641940418619", "309485305738506144784440634031534516502", "18968944470132930394991091305743641460", "224703688285155022586448453991466304058" ], "threshold": 0.9 }, "id": "CVE-2023-48706-99cc3fd0", "source": "https://github.com/vim/vim/commit/26c11c56888d01e298cd8044caf860f3c26f57bb", "target": { "file": "src/version.c" } } ] }