CVE-2017-6350 Amazon Linux Security Advisory for vim: ALAS-2017-809

An integer overflow flaw was found in the way vim handled tree length values when reading an undo file. This bug could result in vim crashing when trying to process corrupted undo files. (CVE-2017-6350 )

An integer overflow flaw was found in the way vim handled undo files. This bug could result in vim crashing when trying to process corrupted undo files.(CVE-2017-6349 )

vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow. (CVE-2017-5953 )

Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.

Please refer to Amazon advisory ALAS-2017-809 for affected packages and patching details, or update with your package manager.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

ALAS-2017-809: Amazon Linux (vim (8.0.0503-1.45.amzn1) on i686)

ALAS-2017-809: Amazon Linux (vim (8.0.0503-1.45.amzn1) on x86_64)

ALAS-2017-809: Amazon Linux (vim (8.0.0503-1.45.amzn1) on src)