Heap-based buffer overflow in Vim - CVE-2022-0417

Vulnerability identifier: #VU60779

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-0417

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to a boundary error. A remote attacker can trick the victim to open a specially crafted file and crash the application.

Vim
Amazon Linux AMI
Gentoo Linux
Ubuntu
openEuler
Fedora
cflinuxfs3
Isolation Segment
VMware Tanzu Application Service for VMs
VMware Tanzu Operations Manager
xxd (Ubuntu package)
vim-gnome (Ubuntu package)
vim-nox (Ubuntu package)
vim-gtk3 (Ubuntu package)
vim (Ubuntu package)
vim-gtk (Ubuntu package)
vim-athena (Ubuntu package)
vim-tiny (Ubuntu package)
vim-X11
vim-filesystem
vim-minimal
vim-debuginfo
vim-enhanced
vim-debugsource
vim
vim-common
app-editors/vim-core
app-editors/vim
app-editors/gvim

Install updates from vendor's website.

Vim - update to 8.2.4245
cflinuxfs3 - update to 0.351.0
Isolation Segment - addressed in versions 2.11.27, 2.12.17, 2.13.12, 3.0.7
VMware Tanzu Application Service for VMs - addressed in versions 2.11.33, 2.12.22, 2.13.15, 3.0.7
VMware Tanzu Operations Manager - update to 3.0.4
xxd (Ubuntu package) - addressed in versions 2:8.0.1453-1ubuntu1.10, 2:8.1.2269-1ubuntu5.11, 2:8.2.3995-1ubuntu2.3
vim-gnome (Ubuntu package) - update to 2:8.0.1453-1ubuntu1.10
vim-nox (Ubuntu package) - addressed in versions 2:8.0.1453-1ubuntu1.10, 2:8.1.2269-1ubuntu5.11, 2:8.2.3995-1ubuntu2.3
vim-gtk3 (Ubuntu package) - addressed in versions 2:8.0.1453-1ubuntu1.10, 2:8.1.2269-1ubuntu5.11, 2:8.2.3995-1ubuntu2.3
vim (Ubuntu package) - addressed in versions 2:8.0.1453-1ubuntu1.10, 2:8.1.2269-1ubuntu5.11, 2:8.2.3995-1ubuntu2.3
vim-gtk (Ubuntu package) - addressed in versions 2:8.0.1453-1ubuntu1.10, 2:8.1.2269-1ubuntu5.11, 2:8.2.3995-1ubuntu2.3
vim-athena (Ubuntu package) - addressed in versions 2:8.0.1453-1ubuntu1.10, 2:8.1.2269-1ubuntu5.11, 2:8.2.3995-1ubuntu2.3
vim-tiny (Ubuntu package) - addressed in versions 2:8.0.1453-1ubuntu1.10, 2:8.1.2269-1ubuntu5.11, 2:8.2.3995-1ubuntu2.3
vim-X11 - update to 8.2-16
vim-filesystem - update to 8.2-16
vim-minimal - update to 8.2-16
vim-debuginfo - update to 8.2-16
vim-enhanced - update to 8.2-16
vim-debugsource - update to 8.2-16
vim - update to 8.2-16
vim-common - update to 8.2-16
vim - addressed in versions 8.2.4314-1.fc34, 8.2.4314-1.fc35, 8.2.4386-1.fc34, 8.2.4428-1.fc34, 8.2.4460-1.fc34
app-editors/vim-core - update to 9.0.0060
app-editors/vim - update to 9.0.0060
app-editors/gvim - update to 9.0.0060
vim - update to 9.0.1160-1.1

• https://huntr.dev/bounties/fc86bc8d-c866-4ade-8b7f-e49cec306d1a
• https://github.com/vim/vim/commit/652dee448618589de5528a9e9a36995803f5557a
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UFXFAILMLUIK4MBUEZO4HNBNKYZRJ5AP/

• Multiple vulnerabilities in Vim
• Amazon Linux AMI update for vim
• Gentoo update for Vim, gVim
• Ubuntu update for vim
• Multiple vulnerabilities in Cloud Foundry Foundation cflinuxfs3
• VMware Tanzu products update for Vim
• openEuler update for vim
• Amazon Linux AMI update for vim
• Fedora 35 update for vim
• Fedora 34 update for vim
• Fedora 34 update for vim
• Fedora 34 update for vim
• Fedora 34 update for vim