CVE-2025-24014

Katalog CVE

CVSS 5.5 · Medium EPSS 0,28%

Kerentanan Out-of-bounds Write pada vim, netapp hci compute node firmware. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.

Rincian

Terbit di NVD

20 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 18,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vim/vim/security/advisories/GHSA-j3g9-wg22-v955 advisory vendor
• https://github.com/vim/vim/commit/9d1bed5eccdbb46a26b8a484f5e9163c40e63919 patch
• https://security.netapp.com/advisory/ntap-20250314-0005/ advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2025/01/20/4 mailing list
• http://www.openwall.com/lists/oss-security/2025/01/21/1 mailing list