CVE-2023-5535: 
NixOS vulnerability analysis and mitigation

A Use-After-Free vulnerability was discovered in the Vim text editor, identified as CVE-2023-5535, affecting versions prior to v9.0.2010. The vulnerability was found in the GitHub repository vim/vim and was related to the buf_contents_changed() function (NVD, GitHub Patch).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High), with the following vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue is classified as CWE-416 (Use After Free) and requires local access with user interaction. The vulnerability stems from improper handling of memory in the buf_contents_changed() function (NVD).

The vulnerability could potentially lead to high impacts on confidentiality, integrity, and availability of the affected system. When successfully exploited, it could allow an attacker to execute arbitrary code with the privileges of the user running Vim (NVD).

The vulnerability has been fixed in Vim version 9.0.2010. The patch blocks autocommands to prevent the use-after-free condition. Users are advised to upgrade to this version or later. Multiple Linux distributions have also released security updates, including Fedora 37, 38, and 39 (Fedora Update).