kritik
CVE-2017-5953
vim: Tree length values not validated properly when handling a spell file
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat2.5CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (düşük), Amazon (düşük), Ubuntu (düşük).
Açıklama
vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alpine 3.10 | neovim, vim | 0.2.0-r0 ve 1 tane daha |
| alpine 3.11 | neovim, vim | 0.2.0-r0 ve 1 tane daha |
| alpine 3.12 | neovim, vim | 0.2.0-r0 ve 1 tane daha |
| alpine 3.13 | neovim, vim | 0.2.0-r0 ve 1 tane daha |
| alpine 3.14 | neovim, vim | 0.2.0-r0 ve 1 tane daha |
| alpine 3.15 | neovim, vim | 0.2.0-r0 ve 1 tane daha |
| alpine 3.16 | neovim, vim | 0.2.0-r0 ve 1 tane daha |
| alpine 3.17 | neovim, vim | 0.2.0-r0 ve 1 tane daha |
| alpine 3.18 | neovim, vim | 0.2.0-r0 ve 1 tane daha |
| alpine 3.19 | neovim, vim | 0.2.0-r0 ve 1 tane daha |
| alpine 3.2 | vim | 7.4.712-r2 |
| alpine 3.20 | neovim, vim | 0.2.0-r0 ve 1 tane daha |
39 kaynaktaki 73 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alpine 3.10 | neovim | 0.2.0-r0 |
| alpine 3.10 | vim | 8.0.0329-r0 |
| alpine 3.11 | neovim | 0.2.0-r0 |
| alpine 3.11 | vim | 8.0.0329-r0 |
| alpine 3.12 | neovim | 0.2.0-r0 |
| alpine 3.12 | vim | 8.0.0329-r0 |
| alpine 3.13 | neovim | 0.2.0-r0 |
| alpine 3.13 | vim | 8.0.0329-r0 |
| alpine 3.14 | neovim | 0.2.0-r0 |
| alpine 3.14 | vim | 8.0.0329-r0 |
| alpine 3.15 | neovim | 0.2.0-r0 |
| alpine 3.15 | vim | 8.0.0329-r0 |
| alpine 3.16 | neovim | 0.2.0-r0 |
| alpine 3.16 | vim | 8.0.0329-r0 |
| alpine 3.17 | neovim | 0.2.0-r0 |
| alpine 3.17 | vim | 8.0.0329-r0 |
| alpine 3.18 | neovim | 0.2.0-r0 |
| alpine 3.18 | vim | 8.0.0329-r0 |
| alpine 3.19 | neovim | 0.2.0-r0 |
| alpine 3.19 | vim | 8.0.0329-r0 |
| alpine 3.2 | vim | 7.4.712-r2 |
| alpine 3.20 | neovim | 0.2.0-r0 |
| alpine 3.20 | vim | 8.0.0329-r0 |
| alpine 3.21 | neovim | 0.2.0-r0 |
| alpine 3.21 | vim | 8.0.0329-r0 |
| alpine 3.22 | neovim | 0.2.0-r0 |
| alpine 3.22 | vim | 8.0.0329-r0 |
| alpine 3.23 | neovim | 0.2.0-r0 |
| alpine 3.23 | vim | 8.0.0329-r0 |
| alpine 3.24 | neovim | 0.2.0-r0 |
| alpine 3.24 | vim | 8.0.0329-r0 |
| alpine 3.3 | vim | 7.4.943-r5 |
| alpine 3.4 | vim | 7.4.1831-r3 |
| alpine 3.5 | vim | 8.0.0329-r0 |
| alpine 3.6 | neovim | 0.2.0-r0 |
| alpine 3.6 | vim | 8.0.0329-r0 |
| alpine 3.7 | neovim | 0.2.0-r0 |
| alpine 3.7 | vim | 8.0.0329-r0 |
| alpine 3.8 | neovim | 0.2.0-r0 |
| alpine 3.8 | vim | 8.0.0329-r0 |
| alpine 3.9 | neovim | 0.2.0-r0 |
| alpine 3.9 | vim | 8.0.0329-r0 |
| alpine edge | neovim | 0.2.0-r0 |
| alpine edge | vim | 8.0.0329-r0 |
| amazon linux 1 | vim-common | 2:8.0.0503-1.45.amzn1 |
| amazon linux 1 | vim-debuginfo | 2:8.0.0503-1.45.amzn1 |
| amazon linux 1 | vim-enhanced | 2:8.0.0503-1.45.amzn1 |
| amazon linux 1 | vim-filesystem | 2:8.0.0503-1.45.amzn1 |
| amazon linux 1 | vim-minimal | 2:8.0.0503-1.45.amzn1 |
| debian 11 | neovim | 0.1.7-4 |
| debian 11 | vim | 2:8.0.0197-2 |
| debian 12 | neovim | 0.1.7-4 |
| debian 12 | vim | 2:8.0.0197-2 |
| debian 13 | neovim | 0.1.7-4 |
| debian 13 | vim | 2:8.0.0197-2 |
| debian 14 | neovim | 0.1.7-4 |
| debian 14 | vim | 2:8.0.0197-2 |
| debian 7 | vim | 2:7.3.547-7+deb7u2 |
| debian 8 | vim | 2:7.4.488-7+deb8u2 |
| echo | neovim | 0.1.7-4 |
| echo | vim | 2:8.0.0197-2 |
| Red Hat | vim | düzeltme belirtilmemiş |
| Red Hat | vim-X11 | düzeltme belirtilmemiş |
| Red Hat | vim-common | düzeltme belirtilmemiş |
| Red Hat | vim-enhanced | düzeltme belirtilmemiş |
| Red Hat | vim-filesystem | düzeltme belirtilmemiş |
| Red Hat | vim-minimal | düzeltme belirtilmemiş |
| root.io alpine 3.18 | rootio-vim | 8.0.0329-r0 |
| root.io alpine 3.19 | rootio-vim | 8.0.0329-r0 |
| root.io debian 12 | rootio-vim | 2:8.0.0197-2 |
| ubuntu 14.04-ESM | vim | 2:7.4.052-1ubuntu3.1+esm1 |
| ubuntu 16.04 | vim | 2:7.4.1689-3ubuntu1.3 |
| ubuntu 16.04-ESM | vim | 2:7.4.1689-3ubuntu1.3 |
Referanslar
- http://www.debian.org/security/2017/dsa-3786
- http://www.securityfocus.com/bid/96217
- https://access.redhat.com/security/cve/CVE-2017-5953
- https://github.com/vim/vim/commit/399c297aa93afe2c0a39e2a1b3f972aebba44c9d
- https://groups.google.com/forum/#!topic/vim_dev/t-3RSdEnrHY
- https://groups.google.com/forum/#%21topic/vim_dev/t-3RSdEnrHY
- https://nvd.nist.gov/vuln/detail/CVE-2017-5953
- https://security.gentoo.org/glsa/201706-26