Ubuntu 24.04 LTS: USN-6993-1 Moderate: Vim Memory Leaks and DoS

ubuntu

September 5, 2024

Several security issues were fixed in Vim.

Summary

Several security issues were fixed in Vim.

Software Description:

- vim: Vi IMproved - enhanced vi editor

Details:

It was discovered that Vim incorrectly handled memory when closing a

window, leading to a double-free vulnerability. If a user was tricked

into opening a specially crafted file, an attacker could crash the

application, leading to a denial of service, or possibly achieve code

execution with user privileges. (CVE-2024-41957)

It was discovered that Vim incorrectly handled memory when adding a new

file to an argument list, leading to a use-after-free. If a user was

tricked into opening a specially crafted file, an attacker could crash

the application, leading to a denial of service. (CVE-2024-43374)

Topics Covered

security advisory denial of service software update code execution Ubuntu memory leak Vim

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
   vim                             2:9.1.0016-1ubuntu7.2

Ubuntu 22.04 LTS
   vim                             2:8.2.3995-1ubuntu2.18

Ubuntu 20.04 LTS
   vim                             2:8.1.2269-1ubuntu5.24

Ubuntu 18.04 LTS
   vim                             2:8.0.1453-1ubuntu1.13+esm9
                                   Available with Ubuntu Pro

Ubuntu 16.04 LTS
   vim                             2:7.4.1689-3ubuntu1.5+esm24
                                   Available with Ubuntu Pro

Ubuntu 14.04 LTS
   vim                             2:7.4.052-1ubuntu3.1+esm18
                                   Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.