An update for vim is now available for openEuler-22.03-LTS-SP1,openEuler-24.03-LTS,openEuler-22.03-LTS-SP4,openEuler-22.03-LTS-SP3,openEuler-20.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2024-2026 Final 1.0 1.0 2024-08-23 Initial 2024-08-23 2024-08-23 openEuler SA Tool V1.0 2024-08-23 vim security update An update for vim is now available for openEuler-22.03-LTS-SP1,openEuler-24.03-LTS,openEuler-22.03-LTS-SP4,openEuler-22.03-LTS-SP3,openEuler-20.03-LTS-SP4 Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems. Security Fix(es): The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers `Buf*` autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying. Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free. Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678.(CVE-2024-43374) An update for vim is now available for openEuler-22.03-LTS-SP1,openEuler-24.03-LTS,openEuler-22.03-LTS-SP4,openEuler-22.03-LTS-SP3,openEuler-20.03-LTS-SP4. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium vim https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2026 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-43374 https://nvd.nist.gov/vuln/detail/CVE-2024-43374 openEuler-22.03-LTS-SP1 openEuler-24.03-LTS openEuler-22.03-LTS-SP4 openEuler-22.03-LTS-SP3 openEuler-20.03-LTS-SP4 vim-X11-9.0-25.oe2203sp1.x86_64.rpm vim-common-9.0-25.oe2203sp1.x86_64.rpm vim-debuginfo-9.0-25.oe2203sp1.x86_64.rpm vim-debugsource-9.0-25.oe2203sp1.x86_64.rpm vim-enhanced-9.0-25.oe2203sp1.x86_64.rpm vim-minimal-9.0-25.oe2203sp1.x86_64.rpm vim-X11-9.0.2092-10.oe2403.x86_64.rpm vim-common-9.0.2092-10.oe2403.x86_64.rpm vim-debuginfo-9.0.2092-10.oe2403.x86_64.rpm vim-debugsource-9.0.2092-10.oe2403.x86_64.rpm vim-enhanced-9.0.2092-10.oe2403.x86_64.rpm vim-minimal-9.0.2092-10.oe2403.x86_64.rpm vim-X11-9.0-25.oe2203sp4.x86_64.rpm vim-common-9.0-25.oe2203sp4.x86_64.rpm vim-debuginfo-9.0-25.oe2203sp4.x86_64.rpm vim-debugsource-9.0-25.oe2203sp4.x86_64.rpm vim-enhanced-9.0-25.oe2203sp4.x86_64.rpm vim-minimal-9.0-25.oe2203sp4.x86_64.rpm vim-X11-9.0-25.oe2203sp3.x86_64.rpm vim-common-9.0-25.oe2203sp3.x86_64.rpm vim-debuginfo-9.0-25.oe2203sp3.x86_64.rpm vim-debugsource-9.0-25.oe2203sp3.x86_64.rpm vim-enhanced-9.0-25.oe2203sp3.x86_64.rpm vim-minimal-9.0-25.oe2203sp3.x86_64.rpm vim-X11-9.0-24.oe2003sp4.x86_64.rpm vim-common-9.0-24.oe2003sp4.x86_64.rpm vim-debuginfo-9.0-24.oe2003sp4.x86_64.rpm vim-debugsource-9.0-24.oe2003sp4.x86_64.rpm vim-enhanced-9.0-24.oe2003sp4.x86_64.rpm vim-minimal-9.0-24.oe2003sp4.x86_64.rpm vim-filesystem-9.0-25.oe2203sp1.noarch.rpm vim-filesystem-9.0.2092-10.oe2403.noarch.rpm vim-filesystem-9.0-25.oe2203sp4.noarch.rpm vim-filesystem-9.0-25.oe2203sp3.noarch.rpm vim-filesystem-9.0-24.oe2003sp4.noarch.rpm vim-9.0-25.oe2203sp1.src.rpm vim-9.0.2092-10.oe2403.src.rpm vim-9.0-25.oe2203sp4.src.rpm vim-9.0-25.oe2203sp3.src.rpm vim-9.0-24.oe2003sp4.src.rpm vim-X11-9.0-25.oe2203sp1.aarch64.rpm vim-common-9.0-25.oe2203sp1.aarch64.rpm vim-debuginfo-9.0-25.oe2203sp1.aarch64.rpm vim-debugsource-9.0-25.oe2203sp1.aarch64.rpm vim-enhanced-9.0-25.oe2203sp1.aarch64.rpm vim-minimal-9.0-25.oe2203sp1.aarch64.rpm vim-X11-9.0.2092-10.oe2403.aarch64.rpm vim-common-9.0.2092-10.oe2403.aarch64.rpm vim-debuginfo-9.0.2092-10.oe2403.aarch64.rpm vim-debugsource-9.0.2092-10.oe2403.aarch64.rpm vim-enhanced-9.0.2092-10.oe2403.aarch64.rpm vim-minimal-9.0.2092-10.oe2403.aarch64.rpm vim-X11-9.0-25.oe2203sp4.aarch64.rpm vim-common-9.0-25.oe2203sp4.aarch64.rpm vim-debuginfo-9.0-25.oe2203sp4.aarch64.rpm vim-debugsource-9.0-25.oe2203sp4.aarch64.rpm vim-enhanced-9.0-25.oe2203sp4.aarch64.rpm vim-minimal-9.0-25.oe2203sp4.aarch64.rpm vim-X11-9.0-25.oe2203sp3.aarch64.rpm vim-common-9.0-25.oe2203sp3.aarch64.rpm vim-debuginfo-9.0-25.oe2203sp3.aarch64.rpm vim-debugsource-9.0-25.oe2203sp3.aarch64.rpm vim-enhanced-9.0-25.oe2203sp3.aarch64.rpm vim-minimal-9.0-25.oe2203sp3.aarch64.rpm vim-X11-9.0-24.oe2003sp4.aarch64.rpm vim-common-9.0-24.oe2003sp4.aarch64.rpm vim-debuginfo-9.0-24.oe2003sp4.aarch64.rpm vim-debugsource-9.0-24.oe2003sp4.aarch64.rpm vim-enhanced-9.0-24.oe2003sp4.aarch64.rpm vim-minimal-9.0-24.oe2003sp4.aarch64.rpm The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers `Buf*` autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying. Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free. Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678. 2024-08-23 CVE-2024-43374 openEuler-22.03-LTS-SP1 openEuler-24.03-LTS openEuler-22.03-LTS-SP4 openEuler-22.03-LTS-SP3 openEuler-20.03-LTS-SP4 Medium 4.5 AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L vim security update 2024-08-23 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2026