NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402.

An update of the vim package has been released.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3463-1 advisory.

  - Divide By Zero in GitHub repository vim/vim prior to 9.0.1367. (CVE-2023-1127)

  - NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392. (CVE-2023-1264)

  - NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402. (CVE-2023-1355)

  - Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. (CVE-2023-2426)

  - NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. (CVE-2023-2609)

  - Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. (CVE-2023-2610)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2103-1 advisory.

  - Divide By Zero in GitHub repository vim/vim prior to 9.0.1367. (CVE-2023-1127)

  - NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392. (CVE-2023-1264)

  - NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402. (CVE-2023-1355)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1716 advisory.

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061. (CVE-2022-2522)

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220. (CVE-2022-2849)

  - Use After Free in GitHub repository vim/vim prior to 9.0.0221. (CVE-2022-2862)

  - Use After Free in GitHub repository vim/vim prior to 9.0.0260. (CVE-2022-2982)

  - Use After Free in GitHub repository vim/vim prior to 9.0.0286. (CVE-2022-3016)

  - Use After Free in GitHub repository vim/vim prior to 9.0.0530. (CVE-2022-3256)

  - Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598. (CVE-2022-3324)

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742. (CVE-2022-3491)

  - A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim     8.1.2269 thru 9.0.0339 allows attackers to cause denial of service or other unspecified impacts.
    (CVE-2022-47024)

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. (CVE-2023-0051)

  - Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. (CVE-2023-0054)

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376. (CVE-2023-1170)

  - Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378. (CVE-2023-1175)

  - NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392. (CVE-2023-1264)

  - NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402. (CVE-2023-1355)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2005 advisory.

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376. (CVE-2023-1170)

  - Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378. (CVE-2023-1175)

  - NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392. (CVE-2023-1264)

  - NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402. (CVE-2023-1355)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-151 advisory.

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376. (CVE-2023-1170)

  - Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378. (CVE-2023-1175)

  - NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392. (CVE-2023-1264)

  - NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402. (CVE-2023-1355)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-030318ca00 advisory.

    Security fixes for CVE-2023-1175, CVE-2023-1170, CVE-2023-1264, CVE-2023-0512, CVE-2023-1355

    ----

    The newest upstream patchlevel 1367

    Security fix for CVE-2023-1127


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
203550	Photon OS 5.0: Vim PHSA-2023-5.0-0009	Nessus	PhotonOS Local Security Checks	high
180294	SUSE SLES12 Security Update : vim (SUSE-SU-2023:3463-1)	Nessus	SuSE Local Security Checks	high
175124	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : vim (SUSE-SU-2023:2103-1)	Nessus	SuSE Local Security Checks	high
173954	Amazon Linux AMI : vim (ALAS-2023-1716)	Nessus	Amazon Linux Local Security Checks	high
173910	Amazon Linux 2 : vim (ALAS-2023-2005)	Nessus	Amazon Linux Local Security Checks	medium
173855	Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-151)	Nessus	Amazon Linux Local Security Checks	medium
173752	Fedora 36 : vim (2023-030318ca00)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2023-1355

medium

Tenable Plugins

high

high

high

high

medium

medium

high