Bug 1427945 (CVE-2017-6350)

Summary: CVE-2017-6350 vim: Integer overflow at an unserialize_uep memory allocation site
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: dkholia, gchamoul, karsten, moshima.web, sardella, zdohnal
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: vim 8.0.0378 Doc Type: If docs needed, set a value
Doc Text:
An integer overflow flaw was found in the way vim handled tree length values when reading an undo file. This bug could result in vim crashing when trying to process corrupted undo files.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2017-03-06 06:26:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1427946    

Description Andrej Nemec 2017-03-01 14:57:31 UTC 
An integer overflow at an unserialize_uep memory allocation site would occur for vim, as it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows. 

Upstream bug:

https://groups.google.com/forum/#!topic/vim_dev/QPZc0CY9j3Y

Upstream patch:

https://github.com/vim/vim/commit/0c8485f0e4931463c0f7986e1ea84a7d79f10c75