USN-5963-1: Vim vulnerabilities

Releases

• Ubuntu 22.10
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM
• Ubuntu 16.04 ESM
• Ubuntu 14.04 ESM

Packages

• vim - Vi IMproved - enhanced vi editor

Details

It was discovered that Vim was not properly performing memory management
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-47024,
CVE-2023-0049, CVE-2023-0054, CVE-2023-0288, CVE-2023-0433)

It was discovered that Vim was not properly performing memory management
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected Ubuntu 22.04
LTS, and Ubuntu 22.10. (CVE-2023-0051)

It was discovered that Vim was not properly performing memory management
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. (CVE-2023-1170, CVE-2023-1175)

It was discovered that Vim was not properly performing memory management
operations. An attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected Ubuntu 20.04
LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2023-1264)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 22.10

• vim-athena - 2:9.0.0242-1ubuntu1.2
• vim-tiny - 2:9.0.0242-1ubuntu1.2
• vim - 2:9.0.0242-1ubuntu1.2
• vim-gtk3 - 2:9.0.0242-1ubuntu1.2
• vim-nox - 2:9.0.0242-1ubuntu1.2

Ubuntu 22.04

• vim-athena - 2:8.2.3995-1ubuntu2.4
• vim-tiny - 2:8.2.3995-1ubuntu2.4
• vim-gtk - 2:8.2.3995-1ubuntu2.4
• vim - 2:8.2.3995-1ubuntu2.4
• vim-gtk3 - 2:8.2.3995-1ubuntu2.4
• vim-nox - 2:8.2.3995-1ubuntu2.4

Ubuntu 20.04

• vim-athena - 2:8.1.2269-1ubuntu5.12
• vim-tiny - 2:8.1.2269-1ubuntu5.12
• vim-gtk - 2:8.1.2269-1ubuntu5.12
• vim - 2:8.1.2269-1ubuntu5.12
• vim-gtk3 - 2:8.1.2269-1ubuntu5.12
• vim-nox - 2:8.1.2269-1ubuntu5.12

Ubuntu 18.04

• vim-athena - 2:8.0.1453-1ubuntu1.11
• vim-tiny - 2:8.0.1453-1ubuntu1.11
• vim-gtk - 2:8.0.1453-1ubuntu1.11
• vim - 2:8.0.1453-1ubuntu1.11
• vim-gtk3 - 2:8.0.1453-1ubuntu1.11
• vim-nox - 2:8.0.1453-1ubuntu1.11

Ubuntu 16.04

• vim-nox-py2 - 2:7.4.1689-3ubuntu1.5+esm17
  Available with Ubuntu Pro
• vim-athena-py2 - 2:7.4.1689-3ubuntu1.5+esm17
  Available with Ubuntu Pro
• vim-athena - 2:7.4.1689-3ubuntu1.5+esm17
  Available with Ubuntu Pro
• vim-gtk - 2:7.4.1689-3ubuntu1.5+esm17
  Available with Ubuntu Pro
• vim - 2:7.4.1689-3ubuntu1.5+esm17
  Available with Ubuntu Pro
• vim-gtk3-py2 - 2:7.4.1689-3ubuntu1.5+esm17
  Available with Ubuntu Pro
• vim-gtk-py2 - 2:7.4.1689-3ubuntu1.5+esm17
  Available with Ubuntu Pro
• vim-tiny - 2:7.4.1689-3ubuntu1.5+esm17
  Available with Ubuntu Pro
• vim-gtk3 - 2:7.4.1689-3ubuntu1.5+esm17
  Available with Ubuntu Pro
• vim-nox - 2:7.4.1689-3ubuntu1.5+esm17
  Available with Ubuntu Pro

Ubuntu 14.04

• vim-athena - 2:7.4.052-1ubuntu3.1+esm7
  Available with Ubuntu Pro
• vim-gtk - 2:7.4.052-1ubuntu3.1+esm7
  Available with Ubuntu Pro
• vim - 2:7.4.052-1ubuntu3.1+esm7
  Available with Ubuntu Pro
• vim-tiny - 2:7.4.052-1ubuntu3.1+esm7
  Available with Ubuntu Pro
• vim-nox - 2:7.4.052-1ubuntu3.1+esm7
  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

• CVE-2023-0054
• CVE-2023-1175
• CVE-2023-0049
• CVE-2023-1264
• CVE-2023-0433
• CVE-2022-47024
• CVE-2023-0051
• CVE-2023-0288
• CVE-2023-1170

Related notices

• USN-5836-1