CVE-2017-6350

An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/96448
http://www.securitytracker.com/id/1037949
https://github.com/vim/vim/commit/0c8485f0e4931463c0f7986e1ea84a7d79f10c75	Patch Third Party Advisory
https://groups.google.com/forum/#%21topic/vim_dev/L_dOHOOiQ5Q
https://groups.google.com/forum/#%21topic/vim_dev/QPZc0CY9j3Y
https://security.gentoo.org/glsa/201706-26
https://usn.ubuntu.com/4309-1/

Configurations

Configuration 1 (hide)

cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-02-27 07:59

Updated : 2023-11-07 02:49

NVD link : CVE-2017-6350

Mitre link : CVE-2017-6350

CVE.ORG link : CVE-2017-6350

JSON object : View

Products Affected

vim

vim

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2017-6350", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2017-02-27T07:59:00.537", "references": [{"url": "http://www.securityfocus.com/bid/96448", "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id/1037949", "source": "cve@mitre.org"}, {"url": "https://github.com/vim/vim/commit/0c8485f0e4931463c0f7986e1ea84a7d79f10c75", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://groups.google.com/forum/#%21topic/vim_dev/L_dOHOOiQ5Q", "source": "cve@mitre.org"}, {"url": "https://groups.google.com/forum/#%21topic/vim_dev/QPZc0CY9j3Y", "source": "cve@mitre.org"}, {"url": "https://security.gentoo.org/glsa/201706-26", "source": "cve@mitre.org"}, {"url": "https://usn.ubuntu.com/4309-1/", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows."}, {"lang": "es", "value": "Un desbordamiento de entero en un sitio de asignaci\u00f3n de memoria unserialize_uep ocurrir\u00eda para vim en versiones anteriores al parche 8.0.0378, si no valida correctamente los valores de longitud del arb\u00f3l de decisi\u00f3n, al leer un archivo desecho corrompido, lo que puede resultar en un desbordamiento de b\u00fafer."}], "lastModified": "2023-11-07T02:49:54.343", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A066C34-AF73-49F8-B14B-F34813E36107", "versionEndIncluding": "8.0.0377"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}