Bug 1427945 (CVE-2017-6350) - CVE-2017-6350 vim: Integer overflow at an unserialize_uep memory allocation site
Summary: CVE-2017-6350 vim: Integer overflow at an unserialize_uep memory allocation site
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2017-6350
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: Embargoed1427946
TreeView+ depends on / blocked
 
Reported: 2017-03-01 14:57 UTC by Andrej Nemec
Modified: 2019-09-29 14:07 UTC (History)
6 users (show)

Fixed In Version: vim 8.0.0378
Doc Type: If docs needed, set a value
Doc Text:
An integer overflow flaw was found in the way vim handled tree length values when reading an undo file. This bug could result in vim crashing when trying to process corrupted undo files.
Clone Of:
Environment:
Last Closed: 2017-03-06 06:26:37 UTC

Attachments (Terms of Use)

Description Andrej Nemec 2017-03-01 14:57:31 UTC 
An integer overflow at an unserialize_uep memory allocation site would occur for vim, as it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows. 

Upstream bug:

https://groups.google.com/forum/#!topic/vim_dev/QPZc0CY9j3Y

Upstream patch:

https://github.com/vim/vim/commit/0c8485f0e4931463c0f7986e1ea84a7d79f10c75
Note You need to log in before you can comment on or make changes to this bug.