Bug 1217321 (CVE-2023-48233)

Summary:	VUL-0: CVE-2023-48233: vim: overflow with count for :s command
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	REOPENED ---	QA Contact:	Security Team bot <security-team>
Severity:	Minor
Priority:	P3 - Medium	CC:	gabriele.sonnu, martin.schreiner, mimi.vx, stoyan.manolov, zbalogh
Version:	unspecified	Flags:	stoyan.manolov: needinfo? (zbalogh)
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/385511/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-48233:2.8:(AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2023-11-20 08:59:57 UTC

If the count after the :s command is larger than what fits into a (signed) long variable, abort with e_value_too_large.

Impact is low, user interaction is required and a crash may not even happen.

The Vim project would like to thank Fabian Toepfer for reporting this issue which is now fixed in Vim patch 9.0.2108.

References:
https://github.com/vim/vim/security/advisories/GHSA-3xx4-hcq6-r2vj

Comment 1 Gabriele Sonnu 2023-11-20 09:01:22 UTC

Tracking all SLE codestreams plus Factory as affected.

Upstream fix:

https://github.com/vim/vim/commit/ac63787734fda2e294e477af52b3bd601517fa78

Comment 4 Zoltan Balogh 2024-02-29 10:55:32 UTC

The next update will deliver the fix

Comment 10 Maintenance Automation 2024-03-06 20:30:08 UTC

SUSE-SU-2024:0783-1: An update that solves 10 vulnerabilities can now be installed.

Category: security (important)
Bug References: 1215005, 1217316, 1217320, 1217321, 1217324, 1217326, 1217329, 1217330, 1217432, 1219581
CVE References: CVE-2023-4750, CVE-2023-48231, CVE-2023-48232, CVE-2023-48233, CVE-2023-48234, CVE-2023-48235, CVE-2023-48236, CVE-2023-48237, CVE-2023-48706, CVE-2024-22667
Sources used:
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): vim-9.1.0111-17.29.1
SUSE Linux Enterprise Server 12 SP5 (src): vim-9.1.0111-17.29.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): vim-9.1.0111-17.29.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 11 Maintenance Automation 2024-03-13 16:30:16 UTC

SUSE-SU-2024:0871-1: An update that solves 10 vulnerabilities can now be installed.

Category: security (important)
Bug References: 1215005, 1217316, 1217320, 1217321, 1217324, 1217326, 1217329, 1217330, 1217432, 1219581
CVE References: CVE-2023-4750, CVE-2023-48231, CVE-2023-48232, CVE-2023-48233, CVE-2023-48234, CVE-2023-48235, CVE-2023-48236, CVE-2023-48237, CVE-2023-48706, CVE-2024-22667
Sources used:
openSUSE Leap Micro 5.3 (src): vim-9.1.0111-150000.5.60.1
openSUSE Leap Micro 5.4 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Micro 5.3 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Micro 5.4 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): vim-9.1.0111-150000.5.60.1
SUSE Manager Proxy 4.3 (src): vim-9.1.0111-150000.5.60.1
SUSE Manager Retail Branch Server 4.3 (src): vim-9.1.0111-150000.5.60.1
SUSE Manager Server 4.3 (src): vim-9.1.0111-150000.5.60.1
SUSE Enterprise Storage 7.1 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Micro 5.1 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Micro 5.2 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src): vim-9.1.0111-150000.5.60.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 12 Maintenance Automation 2024-04-15 16:30:08 UTC

SUSE-SU-2024:1287-1: An update that solves 10 vulnerabilities can now be installed.

Category: security (important)
Bug References: 1215005, 1217316, 1217320, 1217321, 1217324, 1217326, 1217329, 1217330, 1217432, 1219581
CVE References: CVE-2023-4750, CVE-2023-48231, CVE-2023-48232, CVE-2023-48233, CVE-2023-48234, CVE-2023-48235, CVE-2023-48236, CVE-2023-48237, CVE-2023-48706, CVE-2024-22667
Maintenance Incident: [SUSE:Maintenance:32818](https://smelt.suse.de/incident/32818/)
Sources used:
openSUSE Leap 15.5 (src):
 vim-9.1.0111-150500.20.9.1
SUSE Linux Enterprise Micro 5.5 (src):
 vim-9.1.0111-150500.20.9.1
Basesystem Module 15-SP5 (src):
 vim-9.1.0111-150500.20.9.1
Desktop Applications Module 15-SP5 (src):
 vim-9.1.0111-150500.20.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 13 Martin Schreiner 2024-06-19 20:00:01 UTC

I don't think this bug is relevant anymore, as the following codestreams are all shipping Vim 9.1.0330 as of today:

SLE-12:Update
SLE-15-SP5:Update
SLE-15:Update

This CVE is also mentioned on its changelog, so the reference is not missing anywhere.
I'm closing it.

Comment 14 Martin Schreiner 2024-06-20 13:21:11 UTC

Reassigning to security.