USN-6993-1: Vim vulnerabilities

Packages

vim - Vi IMproved - enhanced vi editor

Details

It was discovered that Vim incorrectly handled memory when closing a
window, leading to a double-free vulnerability. If a user was tricked
into opening a specially crafted file, an attacker could crash the
application, leading to a denial of service, or possibly achieve code
execution with user privileges. (CVE-2024-41957)

It was discovered that Vim incorrectly handled memory when adding a new
file to an argument list, leading to a use-after-free. If a user was
tricked into opening a specially crafted file, an attacker could crash
the application, leading to a denial of service. (CVE-2024-43374)

It was discovered that Vim incorrectly handled memory when closing a
window, leading to a double-free vulnerability. If a user was tricked
into opening a specially crafted file, an attacker could crash the
application, leading to a denial of service, or possibly achieve code
execution with user privileges. (CVE-2024-41957)

It was discovered that Vim incorrectly handled memory when adding a new
file to an argument list, leading to a use-after-free. If a user was
tricked into opening a specially crafted file, an attacker could crash
the application, leading to a denial of service. (CVE-2024-43374)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

Ubuntu Release	Package Version
24.04 noble	vim – 2:9.1.0016-1ubuntu7.2
22.04 jammy	vim – 2:8.2.3995-1ubuntu2.18
20.04 focal	vim – 2:8.1.2269-1ubuntu5.24
18.04 bionic	vim – 2:8.0.1453-1ubuntu1.13+esm9
16.04 xenial	vim – 2:7.4.1689-3ubuntu1.5+esm24
14.04 trusty	vim – 2:7.4.052-1ubuntu3.1+esm18

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

Packages

Details

Update instructions

Reduce your security exposure

References