CVE-2017-6349

Name
CVE-2017-6349
Description
An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
cve@mitre.org http://www.securityfocus.com/bid/96451
cve@mitre.org http://www.securitytracker.com/id/1037949
Patch https://github.com/vim/vim/commit/3eb1637b1bba19519885dd6d377bd5596e91d22c
cve@mitre.org https://groups.google.com/forum/#%21topic/vim_dev/LAgsTcdSfNA
cve@mitre.org https://groups.google.com/forum/#%21topic/vim_dev/QPZc0CY9j3Y
cve@mitre.org https://security.gentoo.org/glsa/201706-26
cve@mitre.org https://usn.ubuntu.com/4309-1/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* vim >= None <= 8.0.0376

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
vim edge-main 8.0.1521-r0 None fixed
vim edge-main 8.0.0329-r0 None possibly vulnerable
vim edge-main 8.0.0056-r0 None possibly vulnerable
vim 3.22-main 8.0.1521-r0 None fixed
vim 3.22-main 8.0.0329-r0 None possibly vulnerable
vim 3.22-main 8.0.0056-r0 None possibly vulnerable
vim 3.21-main 8.0.1521-r0 None fixed
vim 3.21-main 8.0.0329-r0 None possibly vulnerable
vim 3.21-main 8.0.0056-r0 None possibly vulnerable
vim 3.20-main 8.0.1521-r0 None fixed
vim 3.20-main 8.0.0329-r0 None possibly vulnerable
vim 3.20-main 8.0.0056-r0 None possibly vulnerable
vim 3.19-main 8.0.1521-r0 None fixed
vim 3.19-main 8.0.0329-r0 None possibly vulnerable
vim 3.19-main 8.0.0056-r0 None possibly vulnerable
vim 3.18-main 8.0.1521-r0 None fixed
vim 3.17-main 8.0.1521-r0 None fixed
vim 3.12-main 8.0.1521-r0 None fixed
vim 3.11-main 8.0.1521-r0 None fixed
vim 3.10-main 8.0.1521-r0 None fixed
neovim edge-community 0.2.0-r0 None fixed
neovim 3.22-community 0.2.0-r0 None fixed
neovim 3.21-community 0.2.0-r0 None fixed
neovim 3.20-community 0.2.0-r0 None fixed
neovim 3.19-community 0.2.0-r0 None fixed
neovim 3.18-community 0.2.0-r0 None fixed
neovim 3.17-community 0.2.0-r0 None fixed
gvim edge-community 8.0.1521-r0 None fixed