crítica
CVE-2017-6349
vim: Integer overflow at a u_read_undo memory allocation site
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat2.5CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (baja), Amazon (baja), Ubuntu (baja).
Descripción
An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.10 | neovim, vim | 0.2.0-r0 y 1 más |
| alpine 3.11 | neovim, vim | 0.2.0-r0 y 1 más |
| alpine 3.12 | neovim, vim | 0.2.0-r0 y 1 más |
| alpine 3.13 | neovim, vim | 0.2.0-r0 y 1 más |
| alpine 3.14 | neovim, vim | 0.2.0-r0 y 1 más |
| alpine 3.15 | neovim, vim | 0.2.0-r0 y 1 más |
| alpine 3.16 | neovim, vim | 0.2.0-r0 y 1 más |
| alpine 3.17 | neovim, vim | 0.2.0-r0 y 1 más |
| alpine 3.18 | neovim, vim | 0.2.0-r0 y 1 más |
| alpine 3.19 | neovim, vim | 0.2.0-r0 y 1 más |
| alpine 3.20 | neovim, vim | 0.2.0-r0 y 1 más |
| alpine 3.21 | neovim, vim | 0.2.0-r0 y 1 más |
Mostrar las 61 entradas de 34 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.10 | neovim | 0.2.0-r0 |
| alpine 3.10 | vim | 8.0.1521-r0 |
| alpine 3.11 | neovim | 0.2.0-r0 |
| alpine 3.11 | vim | 8.0.1521-r0 |
| alpine 3.12 | neovim | 0.2.0-r0 |
| alpine 3.12 | vim | 8.0.1521-r0 |
| alpine 3.13 | neovim | 0.2.0-r0 |
| alpine 3.13 | vim | 8.0.1521-r0 |
| alpine 3.14 | neovim | 0.2.0-r0 |
| alpine 3.14 | vim | 8.0.1521-r0 |
| alpine 3.15 | neovim | 0.2.0-r0 |
| alpine 3.15 | vim | 8.0.1521-r0 |
| alpine 3.16 | neovim | 0.2.0-r0 |
| alpine 3.16 | vim | 8.0.1521-r0 |
| alpine 3.17 | neovim | 0.2.0-r0 |
| alpine 3.17 | vim | 8.0.1521-r0 |
| alpine 3.18 | neovim | 0.2.0-r0 |
| alpine 3.18 | vim | 8.0.1521-r0 |
| alpine 3.19 | neovim | 0.2.0-r0 |
| alpine 3.19 | vim | 8.0.1521-r0 |
| alpine 3.20 | neovim | 0.2.0-r0 |
| alpine 3.20 | vim | 8.0.1521-r0 |
| alpine 3.21 | neovim | 0.2.0-r0 |
| alpine 3.21 | vim | 8.0.1521-r0 |
| alpine 3.22 | neovim | 0.2.0-r0 |
| alpine 3.22 | vim | 8.0.1521-r0 |
| alpine 3.23 | neovim | 0.2.0-r0 |
| alpine 3.23 | vim | 8.0.1521-r0 |
| alpine 3.24 | neovim | 0.2.0-r0 |
| alpine 3.24 | vim | 8.0.1521-r0 |
| alpine 3.6 | neovim | 0.2.0-r0 |
| alpine 3.7 | neovim | 0.2.0-r0 |
| alpine 3.8 | neovim | 0.2.0-r0 |
| alpine 3.8 | vim | 8.0.1521-r0 |
| alpine 3.9 | neovim | 0.2.0-r0 |
| alpine 3.9 | vim | 8.0.1521-r0 |
| alpine edge | neovim | 0.2.0-r0 |
| alpine edge | vim | 8.0.1521-r0 |
| amazon linux 1 | vim-common | 2:8.0.0503-1.45.amzn1 |
| amazon linux 1 | vim-debuginfo | 2:8.0.0503-1.45.amzn1 |
| amazon linux 1 | vim-enhanced | 2:8.0.0503-1.45.amzn1 |
| amazon linux 1 | vim-filesystem | 2:8.0.0503-1.45.amzn1 |
| amazon linux 1 | vim-minimal | 2:8.0.0503-1.45.amzn1 |
| debian 11 | neovim | 0.1.7-4 |
| debian 11 | vim | 2:8.0.0197-3 |
| debian 12 | neovim | 0.1.7-4 |
| debian 12 | vim | 2:8.0.0197-3 |
| debian 13 | neovim | 0.1.7-4 |
| debian 13 | vim | 2:8.0.0197-3 |
| debian 14 | neovim | 0.1.7-4 |
| debian 14 | vim | 2:8.0.0197-3 |
| debian 7 | vim | 2:7.3.547-7+deb7u3 |
| debian 8 | vim | 2:7.4.488-7+deb8u3 |
| echo | neovim | 0.1.7-4 |
| echo | vim | 2:8.0.0197-3 |
| root.io alpine 3.18 | rootio-vim | 8.0.1521-r0 |
| root.io alpine 3.19 | rootio-vim | 8.0.1521-r0 |
| root.io debian 12 | rootio-vim | 2:8.0.0197-3 |
| ubuntu 14.04-ESM | vim | 2:7.4.052-1ubuntu3.1+esm1 |
| ubuntu 16.04 | vim | 2:7.4.1689-3ubuntu1.4 |
| ubuntu 16.04-ESM | vim | 2:7.4.1689-3ubuntu1.4 |
Referencias
- http://www.securityfocus.com/bid/96451
- http://www.securitytracker.com/id/1037949
- https://access.redhat.com/security/cve/CVE-2017-6349
- https://github.com/vim/vim/commit/3eb1637b1bba19519885dd6d377bd5596e91d22c
- https://groups.google.com/forum/#!topic/vim_dev/LAgsTcdSfNA
- https://groups.google.com/forum/#!topic/vim_dev/QPZc0CY9j3Y
- https://groups.google.com/forum/#%21topic/vim_dev/LAgsTcdSfNA
- https://groups.google.com/forum/#%21topic/vim_dev/QPZc0CY9j3Y