Divide By Zero in vim/vim from 9.0.1367-1 to 9.0.1367-3

An update of the vim package has been released.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6452-1 advisory.

    It was discovered that Vim could be made to divide by zero. An attacker could possibly use this issue to     cause a denial of service. This issue only affected Ubuntu 23.04. (CVE-2023-3896)

    It was discovered that Vim did not properly manage memory. An attacker could possibly use this issue to     cause a denial of service or execute arbitrary code. (CVE-2023-4733, CVE-2023-4750)

    It was discovered that Vim contained an arithmetic overflow. An attacker could possibly use this issue to     cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10.
    (CVE-2023-4734)

    It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue     to cause a denial of service or execute arbitrary code. (CVE-2023-4735, CVE-2023-5344)

    It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue     to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 23.04 and Ubuntu     23.10. (CVE-2023-4738)

    It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue     to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu     16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-4751)

    It was discovered that Vim did not properly manage memory. An attacker could possibly use this issue to     cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu     22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-4752, CVE-2023-5535)

    It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue     to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu     22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-4781)

    It was discovered that Vim could be made to dereference invalid memory. An attacker could possibly use     this issue to cause a denial of service. (CVE-2023-5441)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of vim installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-3896 advisory.

  - Divide By Zero in vim/vim from 9.0.1367-1 to 9.0.1367-3 (CVE-2023-3896)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
204361	Photon OS 5.0: Vim PHSA-2023-5.0-0070	Nessus	PhotonOS Local Security Checks	high
204197	Photon OS 4.0: Vim PHSA-2023-4.0-0450	Nessus	PhotonOS Local Security Checks	high
183889	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : Vim vulnerabilities (USN-6452-1)	Nessus	Ubuntu Local Security Checks	high
180351	CBL Mariner 2.0 Security Update: vim (CVE-2023-3896)	Nessus	MarinerOS Local Security Checks	high

Detections

Analytics

CVE-2023-3896

high

Tenable Plugins

high

high

high

high