Veracode Vulnerability DatabaseVERACODE:37007Denial Of Service (DoS)
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.4 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
21.3%
vim/vim is vulnerable to denial of service. The vulnerability exists in FEAT_EVAL function of ex_docmd.c due to improper validations which allows an attacker to trick a user into opening a specially crafted file, triggering use-after-free that causes an application to crash.
References
github.com/vim/vim/commit/35d21c6830fc2d68aca838424a0e786821c5891c
huntr.dev/bounties/403210c7-6cc7-4874-8934-b57f88bd4f5e
lists.debian.org/debian-lts-announce/2022/11/msg00009.html
lists.fedoraproject.org/archives/list/[email protected]/message/DVWBI4BVTBUMNW4NMB3WZZDQJBKIGXI3/
lists.fedoraproject.org/archives/list/[email protected]/message/LLK2RMZEECKKWUQK7J46D2FQZOXFQLTC/
lists.fedoraproject.org/archives/list/[email protected]/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/
secdb.alpinelinux.org/edge/main.yaml
security.gentoo.org/glsa/202305-16
Related
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.4 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
21.3%