CVE-2023-48706 — Use After Free in Cbl2 VIM 9.0.2121-1 ON CBL Mariner 2.0
Severity
4.7MEDIUMNVD
OSV5.5
EPSS
0.1%
top 67.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 22
Latest updateDec 14
Description
Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call causes free-ing of memory which may later then be accessed by the initial `:s` command. The user must intentionally execute the payload and the whole process is a bit tricky to do since it seems to work only reliably for the very first :s c…
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.0 | Impact: 3.6
Affected Packages5 packages
Patches
🔴Vulnerability Details
2📋Vendor Advisories
4Debian▶
CVE-2023-48706: vim - Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free ...↗2023