SB2025092558 - SUSE update for vim

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Path traversal (CVE-ID: CVE-2025-53905)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to input validation error when processing directory traversal sequences in tar.vim plugin. A remote attacker can trick the victim into opening a specially crafted archive and overwrite arbitrary files on the system, leading to remote code execution. 

2) Path traversal (CVE-ID: CVE-2025-53906)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to input validation error when processing directory traversal sequences in zip.vim plugin. A remote attacker can trick the victim into opening a specially crafted archive and overwrite arbitrary files on the system, leading to remote code execution. 

3) Heap-based buffer overflow (CVE-ID: CVE-2025-55157)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the tuple_unref() function. A remote attacker can trick the victim into opening a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

4) Double free (CVE-ID: CVE-2025-55158)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the clear_tv() function when processing handle_import / ex_import code paths. A remote attacker can trick the victim into opening a specially crafted file, trigger a double free error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2025/suse-su-202503300-1/