References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Change History

GitHub, Inc. AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

GitHub, Inc. CWE-122

Vim is an open source, command line text editor. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cursor position always points inside a line and does not become invalid by pointing beyond the end of
a line. Back then we assumed this loop is unnecessary. However, this change made it possible that the cursor position stays invalid and points beyond the end of a line, which would eventually cause a heap-buffer-overflow when trying to access

GitHub, Inc. https://github.com/vim/vim/commit/396fd1ec2956307755392a1 [No types assigned]

GitHub, Inc. https://github.com/vim/vim/releases/tag/v9.1.0038 [No types assigned]

GitHub, Inc. https://github.com/vim/vim/security/advisories/GHSA-wxf9-c5gx-qrwr [No types assigned]