Out-of-bounds read in Vim - CVE-2021-4166

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU60793

Out-of-bounds read in Vim - CVE-2021-4166

Published: February 22, 2022


Vulnerability identifier: #VU60793
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-4166
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to a boundary condition. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and crash the application.


Affected software

Vim
Amazon Linux AMI
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
macOS
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Desktop Applications
openSUSE Leap
openEuler
Fedora
Isolation Segment
VMware Tanzu Application Service for VMs
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Dell Secure Connect Gateway
Dell Data Protection Central
Dell EMC PowerProtect Data Protection
EMC Cloud Tiering Appliance
vim (Ubuntu package)
vim-X11
vim
vim-enhanced
vim-minimal
vim-debuginfo
vim-common
vim-debugsource
vim-filesystem
vim-small-debuginfo
gvim
gvim-debuginfo
vim-small
vim-data
vim-data-common
app-editors/vim-core
app-editors/gvim
app-editors/vim
VMware Tanzu Operations Manager
Dell EMC Storage Monitoring and Reporting (SMR)
EMC ViPR SRM
RecoverPoint for VMs
Dell EMC VxRail Appliance

How to mitigate CVE-2021-4166

Install updates from vendor's website.

Vim - update to 8.2.3884
macOS - addressed in versions 10.15.7 19H2026, 11.6.6 20G624, 12.3 21E230
vim (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2:8.0.1453-1ubuntu1.13, 2:8.1.2269-1ubuntu5.14, 2:8.2.3995-1ubuntu2.7
VMware Tanzu Operations Manager - update to 3.0.8
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.9.0.0
EMC ViPR SRM - update to 4.9.0.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.0.1
Dell Secure Connect Gateway - update to 5.14.00.16
RecoverPoint for VMs - update to 6.0.SP1.P1
Dell EMC VxRail Appliance - addressed in versions 7.0.372, 8.0.000
vim-X11 - update to 8.2-11
vim - update to 8.2-11
vim-enhanced - update to 8.2-11
vim-minimal - update to 8.2-11
vim-debuginfo - update to 8.2-11
vim-common - update to 8.2-11
vim-debugsource - update to 8.2-11
vim-filesystem - update to 8.2-11
vim - addressed in versions 8.2.4006-1.fc34, 8.2.4006-1.fc35, 8.2.4068-1.fc34
vim - addressed in versions 8.2.4006-1.1, 9.0.1160-1.1
vim-small-debuginfo - update to 8.2.5038-150000.5.21.1
gvim - addressed in versions 8.2.5038-150000.5.21.1, 9.0.0814-17.9.1
gvim-debuginfo - addressed in versions 8.2.5038-150000.5.21.1, 9.0.0814-17.9.1
vim - addressed in versions 8.2.5038-150000.5.21.1, 9.0.0814-17.9.1
vim-debuginfo - addressed in versions 8.2.5038-150000.5.21.1, 9.0.0814-17.9.1
vim-debugsource - addressed in versions 8.2.5038-150000.5.21.1, 9.0.0814-17.9.1
vim-small - update to 8.2.5038-150000.5.21.1
vim-data - addressed in versions 8.2.5038-150000.5.21.1, 9.0.0814-17.9.1
vim-data-common - addressed in versions 8.2.5038-150000.5.21.1, 9.0.0814-17.9.1
app-editors/vim-core - update to 9.0.0060
app-editors/gvim - update to 9.0.0060
app-editors/vim - update to 9.0.0060
EMC Cloud Tiering Appliance - update to 13.1.0.2.29

External References

Related Security Bulletins