[Git][security-tracker-team/security-tracker][master] Process three more CVEs for vim

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b1cc7ca3 by Salvatore Bonaccorso at 2023-09-05T20:58:27+02:00
Process three more CVEs for vim

Just doing the first step here for initial tracking, like other vim CVEs
they can further be marked either no-dsa or unimportant. As OOB write
and UAFs they are rather no-dsa.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -23,13 +23,19 @@ CVE-2023-4754 (Out-of-bounds Write in GitHub repository gpac/gpac prior to 2.3-D
 	NOTE: https://github.com/gpac/gpac/commit/7e2e92feb1b30fac1d659f6620d743b5a188ffe0
 	NOTE: https://huntr.dev/bounties/b7ed24ad-7d0b-40b7-8f4d-3c18a906620c
 CVE-2023-4752 (Use After Free in GitHub repository vim/vim prior to 9.0.1858.)
-	TODO: check
+	- vim <unfixed>
+	NOTE: https://huntr.dev/bounties/85f62dd7-ed84-4fa2-b265-8a369a318757/
+	NOTE: https://github.com/vim/vim/commit/ee9166eb3b41846661a39b662dc7ebe8b5e15139 (v9.0.1858)
 CVE-2023-4750 (Use After Free in GitHub repository vim/vim prior to 9.0.1857.)
-	TODO: check
+	- vim <unfixed>
+	NOTE: https://huntr.dev/bounties/1ab3ebdf-fe7d-4436-b483-9a586e03b0ea/
+	NOTE: https://github.com/vim/vim/commit/fc68299d436cf87453e432daa77b6d545df4d7ed (v9.0.1857)
 CVE-2023-4748 (A vulnerability, which was classified as critical, has been found in Y ...)
 	NOT-FOR-US: Yongyou UFIDA-NC
 CVE-2023-4733 (Use After Free in GitHub repository vim/vim prior to 9.0.1840.)
-	TODO: check
+	- vim <unfixed>
+	NOTE: https://huntr.dev/bounties/1ce1fd8c-050a-4373-8004-b35b61590217/
+	NOTE: https://github.com/vim/vim/commit/e1dc9a627536304bc4f738c21e909ad9fcf3974c (v9.0.1840)
 CVE-2023-4636 (The WordPress File Sharing Plugin plugin for WordPress is vulnerable t ...)
 	NOT-FOR-US: WordPress File Sharing Plugin plugin for WordPress
 CVE-2023-4616 (This vulnerability allows remote attackers to disclose sensitive infor ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b1cc7ca371bbd0e56164ae718fb2985dcb8ac0e7

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b1cc7ca371bbd0e56164ae718fb2985dcb8ac0e7
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230905/f5a8c763/attachment.htm>