-----BEGIN PGP SIGNATURE-----
wsF5BAABCAAjFiEE2WgtvmwmcgaEBLlnCAvK1QvD6SAFAmU5SRsFAwAAAAAACgkQCAvK1QvD6SAQ
Zw/+PzhZUX9CNvJf+0AMjqmfzhAS4C2EGJhBT/H6mvteqU1zDV66cxwPvUmJtgjvVMkq8HfpkZiq
V+VS5LJbSI8XTncmuZ1qkSQa5QyIcQQCIIrqgvcL5UCmUC6A7y9j4VJHZleruRD4Bv4edi3gw72e
M34YP1GTsD1uD9p/sN3LncxbzpyCR8HzMkEKWrOTAfk5OgL2Pi6QR9cbZSxgwPtEb1qP/dbFR7Vq
PHmbd2SHdl0TCxXld6sAb6u94ydY2GrfDUg/HRdEwva9tLp9QBrvO9+2KKRKWWWkE1N6PhIkGmjN
iNSNNCxYuL8yO6JS0FFq0oj/m7AKAsiRGDUXLS4H2HJk+AOKIWh6Kl//U0FW+ucLKuvb3MjwJ3aC
4lnKAImI7dB/VcAuKySPkUt84H2q2DvBXIO68PiBJYjSGnVzZwNt+VoBVYedPfHRL0J2HhkJP2li
WZkFsvWiyMlB15MDS+pacuv4Nf942NO/WUoUWdbiRAen58DBgHvKNhjq+3ISLPJdrPduOUroQjT+
Bbvtlr3kBRf739DcHaaAOD+G0uTbUFDSkPbU1CFrpiWy/QRRIoBgbng7GPJkjJ2R5EhGD8N8RhCS
ejdJxzcxS9xoynjQ8nh0CGS2WGjRC09J1Xr4ud0534zsZveQSZ/EABFc6iTu9Gh0AQt4dVi6KErG
39g=
=kdRO
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6452-1
October 25, 2023
vim vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in Vim.
Software Description:
- vim: Vi IMproved - enhanced vi editor
Details:
It was discovered that Vim could be made to divide by zero. An attacker
could possibly use this issue to cause a denial of service. This issue
only affected Ubuntu 23.04. (CVE-2023-3896)
It was discovered that Vim did not properly manage memory. An attacker
could possibly use this issue to cause a denial of service or execute
arbitrary code. (CVE-2023-4733, CVE-2023-4750)
It was discovered that Vim contained an arithmetic overflow. An attacker
could possibly use this issue to cause a denial of service. This issue
only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10.
(CVE-2023-4734)
It was discovered that Vim could be made to write out of bounds. An
attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. (CVE-2023-4735, CVE-2023-5344)
It was discovered that Vim could be made to write out of bounds. An
attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 23.04 and Ubuntu
23.10. (CVE-2023-4738)
It was discovered that Vim could be made to write out of bounds. An
attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu
16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and
Ubuntu 23.04. (CVE-2023-4751)
It was discovered that Vim did not properly manage memory. An attacker
could possibly use this issue to cause a denial of service or execute
arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04
LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-4752, CVE-2023-5535)
It was discovered that Vim could be made to write out of bounds. An
attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-4781)
It was discovered that Vim could be made to dereference invalid memory. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2023-5441)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
vim 2:9.0.1672-1ubuntu2.1
vim-athena 2:9.0.1672-1ubuntu2.1
vim-gtk3 2:9.0.1672-1ubuntu2.1
vim-nox 2:9.0.1672-1ubuntu2.1
vim-tiny 2:9.0.1672-1ubuntu2.1
xxd 2:9.0.1672-1ubuntu2.1
Ubuntu 23.04:
vim 2:9.0.1000-4ubuntu3.2
vim-athena 2:9.0.1000-4ubuntu3.2
vim-gtk3 2:9.0.1000-4ubuntu3.2
vim-nox 2:9.0.1000-4ubuntu3.2
vim-tiny 2:9.0.1000-4ubuntu3.2
xxd 2:9.0.1000-4ubuntu3.2
Ubuntu 22.04 LTS:
vim 2:8.2.3995-1ubuntu2.13
vim-athena 2:8.2.3995-1ubuntu2.13
vim-gtk 2:8.2.3995-1ubuntu2.13
vim-gtk3 2:8.2.3995-1ubuntu2.13
vim-nox 2:8.2.3995-1ubuntu2.13
vim-tiny 2:8.2.3995-1ubuntu2.13
xxd 2:8.2.3995-1ubuntu2.13
Ubuntu 20.04 LTS:
vim 2:8.1.2269-1ubuntu5.20
vim-athena 2:8.1.2269-1ubuntu5.20
vim-gtk 2:8.1.2269-1ubuntu5.20
vim-gtk3 2:8.1.2269-1ubuntu5.20
vim-nox 2:8.1.2269-1ubuntu5.20
vim-tiny 2:8.1.2269-1ubuntu5.20
xxd 2:8.1.2269-1ubuntu5.20
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
vim 2:8.0.1453-1ubuntu1.13+esm6
vim-athena 2:8.0.1453-1ubuntu1.13+esm6
vim-gtk 2:8.0.1453-1ubuntu1.13+esm6
vim-gtk3 2:8.0.1453-1ubuntu1.13+esm6
vim-nox 2:8.0.1453-1ubuntu1.13+esm6
vim-tiny 2:8.0.1453-1ubuntu1.13+esm6
xxd 2:8.0.1453-1ubuntu1.13+esm6
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
vim 2:7.4.1689-3ubuntu1.5+esm20
vim-athena 2:7.4.1689-3ubuntu1.5+esm20
vim-gtk 2:7.4.1689-3ubuntu1.5+esm20
vim-gtk3 2:7.4.1689-3ubuntu1.5+esm20
vim-nox 2:7.4.1689-3ubuntu1.5+esm20
vim-tiny 2:7.4.1689-3ubuntu1.5+esm20
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
vim 2:7.4.052-1ubuntu3.1+esm14
vim-athena 2:7.4.052-1ubuntu3.1+esm14
vim-gtk 2:7.4.052-1ubuntu3.1+esm14
vim-nox 2:7.4.052-1ubuntu3.1+esm14
vim-tiny 2:7.4.052-1ubuntu3.1+esm14
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6452-1
CVE-2023-3896, CVE-2023-4733, CVE-2023-4734, CVE-2023-4735,
CVE-2023-4738, CVE-2023-4750, CVE-2023-4751, CVE-2023-4752,
CVE-2023-4781, CVE-2023-5344, CVE-2023-5441, CVE-2023-5535
Package Information:
https://launchpad.net/ubuntu/+source/vim/2:9.0.1672-1ubuntu2.1
https://launchpad.net/ubuntu/+source/vim/2:9.0.1000-4ubuntu3.2
https://launchpad.net/ubuntu/+source/vim/2:8.2.3995-1ubuntu2.13
https://launchpad.net/ubuntu/+source/vim/2:8.1.2269-1ubuntu5.20
No comments:
Post a Comment