CVE-2023-4750 : Use After Free in GitHub repository vim/vim prior to 9.0.1857.

Use After Free in GitHub repository vim/vim prior to 9.0.1857.

Published 2023-09-04 14:15:08

Updated 2024-02-01 18:01:58

Source huntr.dev

View at NVD, CVE.org

Vulnerability category: Memory Corruption

Products affected by CVE-2023-4750

Apple » Macos
Versions before (<) 14.1
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 37
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 38
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 39
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
Matching versions
VIM » VIM
Versions before (<) 9.0.1857
cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 22 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	huntr.dev
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Assigned by: security@huntr.dev (Primary)

http://seclists.org/fulldisclosure/2023/Oct/24

Full Disclosure: APPLE-SA-10-25-2023-4 macOS Sonoma 14.1
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I56ITJAFMFAQ2G3BMGTCGM3GS62V2DTR/

[SECURITY] Fedora 39 Update: vim-9.0.1872-1.fc39 - package-announce - Fedora Mailing-Lists
Mailing List

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFE3LDFRZ7EGWA5AU7YHYL62ELBOFZWQ/

[SECURITY] Fedora 37 Update: vim-9.0.1872-1.fc37 - package-announce - Fedora Mailing-Lists
Mailing List

CVEs referencing this url
https://support.apple.com/kb/HT213984

About the security content of macOS Sonoma 14.1 - Apple Support
Release Notes;Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITRVK4FB74RZDIGTZJXOZMUW6X6F4TNF/

[SECURITY] Fedora 38 Update: vim-9.0.1872-1.fc38 - package-announce - Fedora Mailing-Lists
Mailing List

CVEs referencing this url
https://github.com/vim/vim/commit/fc68299d436cf87453e432daa77b6d545df4d7ed

patch 9.0.1857: [security] heap-use-after-free in is_qf_win() · vim/vim@fc68299 · GitHub
Patch
https://huntr.dev/bounties/1ab3ebdf-fe7d-4436-b483-9a586e03b0ea

heap-use-after-free in function bt_quickfix vulnerability found in vim
Exploit;Patch;Third Party Advisory

Jump to