Lucene search

K
slackwareSlackware Linux ProjectSSA-2023-254-01
HistorySep 11, 2023 - 8:28 p.m.

[slackware-security] vim

2023-09-1120:28:51
Slackware Linux Project
www.slackware.com
16
slackware
vim
security fix
use-after-free
osu open source lab

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

23.5%

New vim packages are available for Slackware 15.0 and -current to
fix security issues.

Here are the details from the Slackware 15.0 ChangeLog:

patches/packages/vim-9.0.1897-i586-1_slack15.0.txz: Upgraded.
Fixed three use-after-free security issues.
Thanks to marav for the heads-up.
For more information, see:
https://vulners.com/cve/CVE-2023-4733
https://vulners.com/cve/CVE-2023-4752
https://vulners.com/cve/CVE-2023-4750
(* Security fix )
patches/packages/vim-gvim-9.0.1897-i586-1_slack15.0.txz: Upgraded.
Fixed three use-after-free security issues.
Thanks to marav for the heads-up.
For more information, see:
https://vulners.com/cve/CVE-2023-4733
https://vulners.com/cve/CVE-2023-4752
https://vulners.com/cve/CVE-2023-4750
(
Security fix *)

Where to find the new packages:

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the “Get Slack” section on http://slackware.com for
additional mirror sites near you.

Updated packages for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/vim-9.0.1897-i586-1_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/vim-gvim-9.0.1897-i586-1_slack15.0.txz

Updated packages for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/vim-9.0.1897-x86_64-1_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/vim-gvim-9.0.1897-x86_64-1_slack15.0.txz

Updated packages for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/vim-9.0.1897-i586-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/xap/vim-gvim-9.0.1897-i586-1.txz

Updated packages for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ap/vim-9.0.1897-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/xap/vim-gvim-9.0.1897-x86_64-1.txz

MD5 signatures:

Slackware 15.0 packages:
7b1ab1d0c7578222ac1cc1ec0d68a10d vim-9.0.1897-i586-1_slack15.0.txz
405289ec8342c6e24d8f58c92704bb05 vim-gvim-9.0.1897-i586-1_slack15.0.txz

Slackware x86_64 15.0 packages:
5b55051da96a54da33abbd7cc6b5fea7 vim-9.0.1897-x86_64-1_slack15.0.txz
25c441b62792635381b325e61c756a7e vim-gvim-9.0.1897-x86_64-1_slack15.0.txz

Slackware -current packages:
5b4ae2a58dfb49a22a7bafef1e683931 ap/vim-9.0.1897-i586-1.txz
5cf075ec4d9acb1fa269a1e1891a3ad6 xap/vim-gvim-9.0.1897-i586-1.txz

Slackware x86_64 -current packages:
6af81d6dbc909e6c1a828683a4cfc034 ap/vim-9.0.1897-x86_64-1.txz
2c830efaec198718bea605efe251698d xap/vim-gvim-9.0.1897-x86_64-1.txz

Installation instructions:

Upgrade the packages as root:
> upgradepkg vim-9.0.1897-i586-1_slack15.0.txz vim-gvim-9.0.1897-i586-1_slack15.0.txz

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

23.5%