CVE-2017-6349

An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/96451
http://www.securitytracker.com/id/1037949
https://github.com/vim/vim/commit/3eb1637b1bba19519885dd6d377bd5596e91d22c	Patch Third Party Advisory
https://groups.google.com/forum/#%21topic/vim_dev/LAgsTcdSfNA
https://groups.google.com/forum/#%21topic/vim_dev/QPZc0CY9j3Y
https://security.gentoo.org/glsa/201706-26
https://usn.ubuntu.com/4309-1/
http://www.securityfocus.com/bid/96451
http://www.securitytracker.com/id/1037949
https://github.com/vim/vim/commit/3eb1637b1bba19519885dd6d377bd5596e91d22c	Patch Third Party Advisory
https://groups.google.com/forum/#%21topic/vim_dev/LAgsTcdSfNA
https://groups.google.com/forum/#%21topic/vim_dev/QPZc0CY9j3Y
https://security.gentoo.org/glsa/201706-26
https://usn.ubuntu.com/4309-1/

Configurations

Configuration 1 (hide)

cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-02-27 07:59

Updated : 2025-04-20 01:37

NVD link : CVE-2017-6349

Mitre link : CVE-2017-6349

CVE.ORG link : CVE-2017-6349

JSON object : View

Products Affected

vim

vim

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2017-6349", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2017-02-27T07:59:00.503", "references": [{"url": "http://www.securityfocus.com/bid/96451", "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id/1037949", "source": "cve@mitre.org"}, {"url": "https://github.com/vim/vim/commit/3eb1637b1bba19519885dd6d377bd5596e91d22c", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://groups.google.com/forum/#%21topic/vim_dev/LAgsTcdSfNA", "source": "cve@mitre.org"}, {"url": "https://groups.google.com/forum/#%21topic/vim_dev/QPZc0CY9j3Y", "source": "cve@mitre.org"}, {"url": "https://security.gentoo.org/glsa/201706-26", "source": "cve@mitre.org"}, {"url": "https://usn.ubuntu.com/4309-1/", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/96451", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1037949", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/vim/vim/commit/3eb1637b1bba19519885dd6d377bd5596e91d22c", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://groups.google.com/forum/#%21topic/vim_dev/LAgsTcdSfNA", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://groups.google.com/forum/#%21topic/vim_dev/QPZc0CY9j3Y", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.gentoo.org/glsa/201706-26", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://usn.ubuntu.com/4309-1/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows."}, {"lang": "es", "value": "Un desbordamiento de entero en un sitio de asignaci\u00f3n de memoria u_read_undo ocurrir\u00eda para vim en versiones anteriores al parche 8.0.0377, si no valida correctamente los valores de longitud del \u00e1rbol de decisi\u00f3n, al leer un archivo desecho corrompido, lo que puede resultar en un desbordamiento de b\u00fafer."}], "lastModified": "2025-04-20T01:37:25.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83EDAAC0-DAD8-494F-98A8-522604E389D5", "versionEndIncluding": "8.0.0376"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}