CVE-2017-5953 Integer overflow in n/a
An integer overflow in Vim's spell file handling can lead to a buffer overflow, potentially allowing code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-5953?
CVE-2017-5953 is a critical vulnerability in Vim Vim, published on 10 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.
Weakness: CWE-190
Which versions are affected by CVE-2017-5953?
It affects 1 product.
Linux distribution packages (2)
vim SUSE:Linux Enterprise Server 11 SP4 | All versions | 7.2-8.20.8 |
vim SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 7.2-8.20.8 |
Products include Vim Vim.
How do I fix CVE-2017-5953?
Apply the vendor's patch.
Is CVE-2017-5953 being exploited?
There is no known exploitation of CVE-2017-5953 in the wild and no public exploit code.
Other vulnerabilities in Vim Vim
Sources
Also known as ALPINE-CVE-2017-5953, DEBIAN-CVE-2017-5953, DLA-822-1, DSA-3786-1, GHSA-j83f-g7mr-qg5h, SUSE-SU-2017:1775-1 and 1 more.