CVE-2024-47814 — use-after-free when closing buffers in Vim

Affected: vim

Vim is an open source, command line text editor. A use-after-free was found in Vim < 9.1.0764. When closing a buffer (visible in a window) a BufWinLeave auto command can cause an use-after-free if this auto command happens to re-open the same buffer in a new split window. Impact is low since the user must have intentionally set up such a strange auto command and run some buffer unload commands. However this may lead to a crash. This issue has been addressed in version 9.1.0764 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

USN-7131-1 — vim vulnerability

Affected: Ubuntu:Pro:14.04:LTS: vim, Ubuntu:Pro:16.04:LTS: vim, Ubuntu:Pro:18.04:LTS: vim, Ubuntu:20.04:LTS: vim, Ubuntu:22.04:LTS: vim, Ubuntu:24.04:LTS: vim

It was discovered that Vim incorrectly handled memory when closing a buffer, leading to use-after-free. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service.

Most recent entries from all

CVE-2024-47814 — use-after-free when closing buffers in Vim

USN-7131-1 — vim vulnerability