CVE-2023-48237
Public on 2023-11-16
Modified on 2024-03-27
Description
Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `6bf131888` which has been included in version 9.0.2112. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
CVSS v3 Base Score
See breakdown
Affected Packages
Platform | Package | Release Date | Advisory | Status |
---|---|---|---|---|
Amazon Linux 1 | vim | 2024-01-03 | ALAS-2024-1902 | Fixed |
Amazon Linux 2 - Core | vim | 2023-11-29 | ALAS2-2023-2353 | Fixed |
Amazon Linux 2023 | vim | 2023-12-06 | ALAS2023-2023-447 | Fixed |
CVSS Scores
Score Type | Score | Vector | |
---|---|---|---|
Amazon Linux | CVSSv3 | 2.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L |
NVD | CVSSv3 | 2.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L |