Bugzilla – Bug 1027053
VUL-1: CVE-2017-6350: vim: An integer overflow at an unserialize_uep memory allocation site wouldoccur for vim before patch 8....
Last modified: 2019-06-14 06:41:02 UTC
CVE-2017-6350 An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows. MISC:https://github.com/vim/vim/commit/0c8485f0e4931463c0f7986e1ea84a7d79f10c75 MISC:https://groups.google.com/forum/#!topic/vim_dev/L_dOHOOiQ5Q MISC:https://groups.google.com/forum/#!topic/vim_dev/QPZc0CY9j3Y
the array usage code in sle11 ga vim has the same pattern, just "newarray" instead of "array" and other variables also named differently.
bugbot adjusting priority
this was not included in the last vim szubmissions. can you check if it applies and submit
Fix submitted for SLE12, SLE11 and below doesn't have undo serialization hence not affected.
SUSE-SU-2017:1712-1: An update that solves three vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1018870,1024724,1027053,1027057 CVE References: CVE-2017-5953,CVE-2017-6349,CVE-2017-6350 Sources used: SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): vim-7.4.326-16.1 SUSE Linux Enterprise Server 12-SP2 (src): vim-7.4.326-16.1 SUSE Linux Enterprise Desktop 12-SP2 (src): vim-7.4.326-16.1 OpenStack Cloud Magnum Orchestration 7 (src): vim-7.4.326-16.1
openSUSE-SU-2017:1811-1: An update that solves three vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1018870,1024724,1027053,1027057 CVE References: CVE-2017-5953,CVE-2017-6349,CVE-2017-6350 Sources used: openSUSE Leap 42.2 (src): vim-7.4.326-10.3.1
Fixed.