CVE-2023-48234

MediumCVSS 4.3/10Last modified Jun 23, 2026

Description

Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `58f9befca1` which has been included in release version 9.0.2109. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
vim	vim	< 9.0.2109

References

http://www.openwall.com/lists/oss-security/2023/11/16/1Mailing List
https://github.com/vim/vim/commit/58f9befca1fa172068effad7f2ea5a9d6a7b0ccaPatch
https://github.com/vim/vim/security/advisories/GHSA-59gw-c949-6phqVendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4UJAK2W5S7G75ETDAEM3BDUCVSXCEGRD/Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M3VQF7CL3V6FGSEW37WNDFBRRILR65AK/Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNRNYLWXZOGTYWE5HMFNQ5FVE3HBUHF6/Mailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20231227-0004/Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/11/16/1Mailing List
https://github.com/vim/vim/commit/58f9befca1fa172068effad7f2ea5a9d6a7b0ccaPatch
https://github.com/vim/vim/security/advisories/GHSA-59gw-c949-6phqVendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4UJAK2W5S7G75ETDAEM3BDUCVSXCEGRD/Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M3VQF7CL3V6FGSEW37WNDFBRRILR65AK/Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNRNYLWXZOGTYWE5HMFNQ5FVE3HBUHF6/Mailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20231227-0004/Third Party Advisory

Timeline

Published: Nov 16, 2023
Last modified: Jun 23, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-482354.3Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an overflow. Ironically thi CVE-2023-482364.3Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAX_INT. CVE-2023-482374.3Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large val CVE-2023-482387.5joaquimserafim/json-web-token is a javascript library use to interact with JSON Web Tokens (JWT) which are a compact URL-safe means of repre CVE-2023-482397.1Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.1 CVE-2023-48248.8The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logg CVE-2023-482408.8XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents and not display a dif CVE-2023-482417.5XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 14.10.15, 15.5.1, and 15.6RC1, the Solr CVE-2023-482426.5The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the ap CVE-2023-482438.8The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user CVE-2023-482446.1The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted U CVE-2023-482459.8The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user (“root”)