Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648.
{ "vanir_signatures": [ { "signature_type": "Line", "target": { "file": "src/version.c" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "146200493773228420153804765641940418619", "319068576336015303654870632066556216911", "178563506805096978316365411572304971534", "103866325697220096823787096222625492069" ] }, "source": "https://github.com/vim/vim/commit/b29f4abcd4b3382fa746edd1d0562b7b48c9de60", "deprecated": false, "id": "CVE-2024-41965-37ddfcf6" }, { "signature_type": "Line", "target": { "file": "src/ex_cmds2.c" }, "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "208460236667585611550014454444459001684", "47561753496803494013132493144902166888", "64918886378476369114116130504994470708", "218441320039957642159090358074181675959", "279270165435357312255759665662653512285", "68041810321967682710134210647078424877" ] }, "source": "https://github.com/vim/vim/commit/b29f4abcd4b3382fa746edd1d0562b7b48c9de60", "deprecated": false, "id": "CVE-2024-41965-5bb1bb7b" }, { "signature_type": "Function", "target": { "file": "src/ex_cmds2.c", "function": "dialog_changed" }, "signature_version": "v1", "digest": { "length": 1534.0, "function_hash": "100140338462924349444709213450817516896" }, "source": "https://github.com/vim/vim/commit/b29f4abcd4b3382fa746edd1d0562b7b48c9de60", "deprecated": false, "id": "CVE-2024-41965-cdb60219" } ] }