Out-of-bounds read in Vim - CVE-2022-0393

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU60784

Out-of-bounds read in Vim - CVE-2022-0393

Published: February 22, 2022


Vulnerability identifier: #VU60784
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-0393
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to a boundary condition when recording and using Select mode . A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and crash the application.


Affected software

Vim
Amazon Linux AMI
Gentoo Linux
Ubuntu
Fedora
Isolation Segment
VMware Tanzu Application Service for VMs
VMware Tanzu Operations Manager
vim-athena (Ubuntu package)
xxd (Ubuntu package)
vim (Ubuntu package)
vim-tiny (Ubuntu package)
vim-gtk3 (Ubuntu package)
vim-nox (Ubuntu package)
vim
app-editors/gvim
app-editors/vim
app-editors/vim-core

How to mitigate CVE-2022-0393

Install updates from vendor's website.

Vim - update to 8.2.4233
VMware Tanzu Operations Manager - update to 3.0.14
vim-athena (Ubuntu package) - update to 2:8.2.3995-1ubuntu2.9
xxd (Ubuntu package) - update to 2:8.2.3995-1ubuntu2.9
vim (Ubuntu package) - update to 2:8.2.3995-1ubuntu2.9
vim-tiny (Ubuntu package) - update to 2:8.2.3995-1ubuntu2.9
vim-gtk3 (Ubuntu package) - update to 2:8.2.3995-1ubuntu2.9
vim-nox (Ubuntu package) - update to 2:8.2.3995-1ubuntu2.9
vim - addressed in versions 8.2.4314-1.fc34, 8.2.4314-1.fc35, 8.2.4386-1.fc34, 8.2.4428-1.fc34, 8.2.4460-1.fc34
app-editors/gvim - update to 9.0.0060
app-editors/vim - update to 9.0.0060
app-editors/vim-core - update to 9.0.0060
vim - update to 9.0.1160-1.1

External References

Related Security Bulletins