Fedora has issued an advisory on May 20: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/LOJP6M7ZTKZQYOGVOOAY6TIE6ACBJL55/ The issue is fixed upstream in 9.0.1499. Mageia 8 is also affected.
Status comment: (none) => Fixed upstream in 9.0.1499Whiteboard: (none) => MGA8TOO
Suggested advisory: ======================== The updated packages fix a security vulnerability: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. (CVE-2023-2426) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2426 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/LOJP6M7ZTKZQYOGVOOAY6TIE6ACBJL55/ ======================== Updated packages in core/updates_testing: ======================== vim-X11-9.0.1572-1.mga8 vim-common-9.0.1572-1.mga8 vim-enhanced-9.0.1572-1.mga8 vim-minimal-9.0.1572-1.mga8 from SRPM: vim-9.0.1572-1.mga8.src.rpm
CC: (none) => nicolas.salgueroAssignee: bugsquad => qa-bugsStatus: NEW => ASSIGNEDStatus comment: Fixed upstream in 9.0.1499 => (none)Whiteboard: MGA8TOO => (none)Version: Cauldron => 8CVE: (none) => CVE-2023-2426
MGA8-64 MATE on Acer Aspire 5253 No installation issues Opened plain text file, inserted and added some text, deleted a line, wrote the fie back and quit. Reviewed the changes with mousepad, all OK Ref bug 31766: $ vim -r Swap files found: In current directory: -- none -- In directory ~/tmp: -- none -- In directory /var/tmp: -- none -- In directory /tmp: -- none -- I haven't come across the usage of swap files for a looooong time, so I guess this is all OK.
CC: (none) => herman.viaeneWhiteboard: (none) => MGA8-64-OK
Validating. Advisory in comment 1.
Keywords: (none) => validated_updateCC: (none) => andrewsfarm, sysadmin-bugs
CC: (none) => davidwhodginsKeywords: (none) => advisory
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2023-0192.html
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED
This problem has been updated in the Mageia Updates repository. https://1v1-lol.io
CC: (none) => noteminnow
This update also fixed CVE-2023-2610: https://www.debian.org/lts/security/2023/dla-3453 It was fixed upstream in 9.0.1532.
This update also fixed CVE-2023-2609: https://ubuntu.com/security/notices/USN-6154-1 It was fixed upstream in 9.0.1531.