SUSE-SU-2024:4330-1

LOW3.9

Security update for vim

Published Dec 16, 2024

Modified 1 years ago

Fix available

Details

Description of the patch:

This update for vim fixes the following issues:

CVE-2024-47814: Fixed use-after-free when closing buffers in Vim (bsc#1231373)
CVE-2024-43374: Fixed use-after-free in alist_add() (bsc#1229238)

Other fixes:

Updated to version 9.1.0836

Affected Packages

vim

SUSE Linux Enterprise Desktop 15 SP5SUSE Linux Enterprise Desktop 15 SP6SUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP6SUSE Linux Enterprise Module for Basesystem 15 SP5

Fixed in:

9.1.0836-150500.20.15.1

vim-data

SUSE Linux Enterprise Desktop 15 SP5SUSE Linux Enterprise Desktop 15 SP6SUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP6SUSE Linux Enterprise Module for Basesystem 15 SP5

Fixed in:

9.1.0836-150500.20.15.1

vim-data-common

SUSE Linux Enterprise Desktop 15 SP5SUSE Linux Enterprise Desktop 15 SP6SUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP6SUSE Linux Enterprise Micro 5.5

Fixed in:

9.1.0836-150500.20.15.1

vim-small

SUSE Linux Enterprise Desktop 15 SP5SUSE Linux Enterprise Desktop 15 SP6SUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP6SUSE Linux Enterprise Micro 5.5

Fixed in:

9.1.0836-150500.20.15.1

gvim

SUSE Linux Enterprise Module for Desktop Applications 15 SP5SUSE Linux Enterprise Module for Desktop Applications 15 SP6openSUSE Leap 15.5openSUSE Leap 15.6

Fixed in:

9.1.0836-150500.20.15.1

References

https://bugzilla.suse.com/1229238

https://bugzilla.suse.com/1231373

https://lists.suse.com/pipermail/sle-security-updates/2024-December/020004.html

https://www.suse.com/security/cve/CVE-2024-43374/

https://www.suse.com/security/cve/CVE-2024-47814/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2024/suse-su-20244330-1/

CVSS Analysis

CVSS v3.1

3.9

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

LowI:L

Availability

LowA:L

3.9/CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Upstream

CVE-2024-43374 CVE-2024-47814

Ecosystems(16)

SUSE Linux Enterprise Desktop 15 SP5 SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SP5 SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Micro 5.5

Timeline

PublishedDec 16, 2024

ModifiedDec 16, 2024

SUSE-SU-2024:4330-1 | Mondoo Vulnerability Intelligence