The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers `Buf*` autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying. Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free. Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678.

The version of vim installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-43374 advisory.

  - The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When     adding a new file to the argument list, this triggers `Buf*` autocommands. If in such an autocommand the     buffer that was just opened is closed (including the window where it is shown), this causes the window     structure to be freed which contains a reference to the argument list that we are actually modifying. Once     the autocommands are completed, the references to the window and argument list are no longer valid and as     such cause an use-after-free. Impact is low since the user must either intentionally add some unusual     autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but     it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678. (CVE-2024-43374)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-055adf8e6f advisory.

    Security fix for CVE-2024-45306

    ----

    patchlevel 703

    Security fixes for CVE-2024-43374, CVE-2024-43802

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6993-1 advisory.

    It was discovered that Vim incorrectly handled memory when closing a window, leading to a double-free     vulnerability. If a user was tricked into opening a specially crafted file, an attacker could crash the

    application, leading to a denial of service, or possibly achieve code

    execution with user privileges. (CVE-2024-41957)

    It was discovered that Vim incorrectly handled memory when adding a new file to an argument list, leading     to a use-after-free. If a user was

    tricked into opening a specially crafted file, an attacker could crash the application, leading to a     denial of service. (CVE-2024-43374)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-bb4b6da0b6 advisory.

    patchlevel 703

    Security fixes for CVE-2024-43374, CVE-2024-43802

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Vim installed on the remote host is prior to 9.1.0678. It is, therefore, affected by a vulnerability as referenced in the advisory.

  - The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When     adding a new file to the argument list, this triggers `Buf*` autocommands. If in such an autocommand the     buffer that was just opened is closed (including the window where it is shown), this causes the window     structure to be freed which contains a reference to the argument list that we are actually modifying. Once     the autocommands are completed, the references to the window and argument list are no longer valid and as     such cause an use-after-free. Impact is low since the user must either intentionally add some unusual     autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but     it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678. (CVE-2024-43374)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the vim package has been released.

ID	Name	Product	Family	Severity
207040	CBL Mariner 2.0 Security Update: vim (CVE-2024-43374)	Nessus	MarinerOS Local Security Checks	medium
207006	Fedora 39 : vim (2024-055adf8e6f)	Nessus	Fedora Local Security Checks	medium
206625	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Vim vulnerabilities (USN-6993-1)	Nessus	Ubuntu Local Security Checks	medium
206414	Fedora 40 : vim (2024-bb4b6da0b6)	Nessus	Fedora Local Security Checks	medium
206156	Vim < 9.1.0678 Heap-Use	Nessus	Windows	medium
206091	Photon OS 5.0: Vim PHSA-2024-5.0-0352	Nessus	PhotonOS Local Security Checks	medium
206090	Photon OS 4.0: Vim PHSA-2024-4.0-0671	Nessus	PhotonOS Local Security Checks	medium

Detections

Analytics

CVE-2024-43374

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium