Ubuntu
vim package

vim 2:9.0.1672-1ubuntu2.2 source package in Ubuntu

Changelog

vim (2:9.0.1672-1ubuntu2.2) mantic-security; urgency=medium

  * SECURITY UPDATE: use-after-free vulnerability
    - debian/patches/CVE-2023-46246.patch: Check that the return value from the
      vim_str2nr() function is not larger than INT_MAX and if yes, bail out with
      an error.
    - CVE-2023-46246
  * SECURITY UPDATE: use-after-free vulnerability
    - debian/patches/CVE-2023-48231.patch: If the current window structure is
      no longer valid, fail and return before attempting to set win->w_closing
      variable.
    - CVE-2023-48231
  * SECURITY UPDATE: division by zero
    - debian/patches/CVE-2023-48232-*.patch: Prevent a floating point exception
      when calculating w_skipcol (which can happen with a small window when the
      number option is set and cpo+=n).
    - CVE-2023-48232
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2023-48233.patch: If the count after the :s command is
      larger than what fits into a (signed) long variable, abort with
      e_value_too_large.
    - CVE-2023-48233
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2023-48234.patch: When getting the count for a normal z
      command, it may overflow for large counts given. So verify, that we can
      safely store the result in a long.
    - CVE-2023-48234
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2023-48235.patch: When parsing relative ex addresses
      one may unintentionally cause an overflow (because LONG_MAX - lnum will
      overflow for negative addresses).
    - CVE-2023-48235
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2023-48236.patch: When using the z= command, we may
      overflow the count with values larger than MAX_INT. So verify that we do
      not overflow and in case when an overflow is detected, simply return 0.
    - CVE-2023-48236
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2023-48237.patch: When shifting lines in operator
      pending mode and using a very large value, we may overflow the size of
      integer. Fix this by using a long variable, testing if the result would
      be larger than INT_MAX and if so, indent by INT_MAX value.
    - CVE-2023-48237
  * SECURITY UPDATE: use-after-free vulnerability
    - debian/patches/CVE-2023-48706.patch: ensure that the sub var always using
      allocated memory.
    - CVE-2023-48706

 -- Fabian Toepfer <email address hidden>  Mon, 04 Dec 2023 13:42:16 +0100

Upload details

Uploaded by:
Fabian Toepfer
Uploaded to:
Mantic
Original maintainer:
Ubuntu Developers
Architectures:
any all
Section:
editors
Urgency:
Medium Urgency

See full publishing history Publishing

Series Pocket Published Component Section

Downloads

File Size SHA-256 Checksum
vim_9.0.1672.orig.tar.xz 10.7 MiB 9dbe5fee14c0c2ad2c818000a499bfb4839b2f5de820519df559c6e6cd2ca217
vim_9.0.1672-1ubuntu2.2.debian.tar.xz 213.8 KiB ddb24e1594fcf5b58f321cedd1474311ffb8d672702b405a5c9211b043be5abc
vim_9.0.1672-1ubuntu2.2.dsc 3.0 KiB 2ad98f9d53bc50c5cdcb5d2daf1ece221727968a96ee68980b7ba843a7450f07

View changes file

Binary packages built by this source

vim: Vi IMproved - enhanced vi editor

 Vim is an almost compatible version of the UNIX editor Vi.
 .
 Many new features have been added: multi level undo, syntax
 highlighting, command line history, on-line help, filename
 completion, block operations, folding, Unicode support, etc.
 .
 This package contains a version of vim compiled with a rather
 standard set of features. This package does not provide a GUI
 version of Vim. See the other vim-* packages if you need more
 (or less).

vim-athena: Vi IMproved - enhanced vi editor (dummy package)

 This is a transitional package to install the vim-motif package. You may
 remove this package if nothing depends on it.

vim-common: Vi IMproved - Common files

 Vim is an almost compatible version of the UNIX editor Vi.
 .
 This package contains files shared by all non GUI-enabled vim variants
 available in Debian. Examples of such shared files are: manpages and
 configuration files.

vim-dbgsym: debug symbols for vim
vim-doc: Vi IMproved - HTML documentation

 Vim is an almost compatible version of the UNIX editor Vi.
 .
 This package contains the HTML version of the online documentation. It is
 built from the runtime/doc directory of the source tree.

vim-gtk3: Vi IMproved - enhanced vi editor - with GTK3 GUI

 Vim is an almost compatible version of the UNIX editor Vi.
 .
 Many new features have been added: multi level undo, syntax
 highlighting, command line history, on-line help, filename
 completion, block operations, folding, Unicode support, etc.
 .
 This package contains a version of vim compiled with a GTK3 GUI
 and support for scripting with Lua, Perl, Python 3, Ruby, and Tcl.

vim-gtk3-dbgsym: debug symbols for vim-gtk3
vim-gui-common: Vi IMproved - Common GUI files

 Vim is an almost compatible version of the UNIX editor Vi.
 .
 This package contains files shared by all GUI-enabled vim
 variants available in Debian. Examples of such shared files are:
 gvimtutor, icons, and desktop environments settings.

vim-motif: Vi IMproved - enhanced vi editor - with Motif GUI

 Vim is an almost compatible version of the UNIX editor Vi.
 .
 Many new features have been added: multi level undo, syntax
 highlighting, command line history, on-line help, filename
 completion, block operations, folding, Unicode support, etc.
 .
 This package contains a version of vim compiled with a Motif GUI
 and support for scripting with Lua, Perl, Python 3, and Tcl.

vim-motif-dbgsym: debug symbols for vim-motif
vim-nox: Vi IMproved - enhanced vi editor - with scripting languages support

 Vim is an almost compatible version of the UNIX editor Vi.
 .
 Many new features have been added: multi level undo, syntax
 highlighting, command line history, on-line help, filename
 completion, block operations, folding, Unicode support, etc.
 .
 This package contains a version of vim compiled with support for
 scripting with Lua, Perl, Python 3, Ruby, and Tcl but no GUI.

vim-nox-dbgsym: debug symbols for vim-nox
vim-runtime: Vi IMproved - Runtime files

 Vim is an almost compatible version of the UNIX editor Vi.
 .
 This package contains vimtutor and the architecture independent runtime
 files, used, if available, by all vim variants available in Debian.
 Example of such runtime files are: online documentation, rules for
 language-specific syntax highlighting and indentation, color schemes,
 and standard plugins.

vim-tiny: Vi IMproved - enhanced vi editor - compact version

 Vim is an almost compatible version of the UNIX editor Vi.
 .
 This package contains a minimal version of Vim compiled with no GUI and
 a small subset of features. This package's sole purpose is to provide
 the vi binary for base installations.
 .
 If a vim binary is wanted, try one of the following more featureful
 packages: vim, vim-nox, vim-motif, or vim-gtk3.

vim-tiny-dbgsym: debug symbols for vim-tiny
xxd: tool to make (or reverse) a hex dump

 xxd creates a hex dump of a given file or standard input. It can also convert
 a hex dump back to its original binary form.

xxd-dbgsym: debug symbols for xxd