Use of Out-of-range Pointer Offset in Vim - CVE-2022-1420

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU63044

Use of Out-of-range Pointer Offset in Vim - CVE-2022-1420

Published: May 11, 2022 / Updated: May 12, 2022


Vulnerability identifier: #VU63044
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-1420
CWE-ID: CWE-823
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service on the target application.

The vulnerability exists due to a boundary error. A remote attacker can trick the victim to open a specially crafted file, trigger a use of out-of-range pointer offset and crash the application.


Affected software

Vim
Amazon Linux AMI
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Oracle Linux
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Desktop Applications
openSUSE Leap
Fedora
macOS
Dell Data Protection Central
Dell EMC PowerProtect Data Protection
EMC Cloud Tiering Appliance
Dell EMC Storage Monitoring and Reporting (SMR)
EMC ViPR SRM
Dell Secure Connect Gateway
Dell EMC VxRail Appliance
vim (Ubuntu package)
vim (Red Hat package)
vim
gvim-debuginfo
vim-data
gvim
vim-debuginfo
vim-debugsource
vim-small
vim-small-debuginfo
vim-data-common
app-editors/vim
app-editors/gvim
app-editors/vim-core

How to mitigate CVE-2022-1420

Install updates from vendor's website.

Vim - update to 8.2.4774
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.9.0.0
EMC ViPR SRM - update to 4.9.0.0
Dell Secure Connect Gateway - update to 5.14.00.16
Dell EMC VxRail Appliance - addressed in versions 7.0.372, 8.0.000
vim (Ubuntu package) - addressed in versions 2:8.0.1453-1ubuntu1.9, 2:8.1.2269-1ubuntu5.8, 2:8.1.2269-1ubuntu5.9, 2:8.2.3995-1ubuntu2.1
vim (Red Hat package) - update to 8.2.2637-16.el9_0.2
vim - addressed in versions 8.2.4804-1.fc34, 8.2.4804-1.fc35, 8.2.4804-1.fc36
gvim-debuginfo - addressed in versions 8.2.5038-150000.5.21.1, 9.0.0814-17.9.1
vim-data - addressed in versions 8.2.5038-150000.5.21.1, 9.0.0814-17.9.1
gvim - addressed in versions 8.2.5038-150000.5.21.1, 9.0.0814-17.9.1
vim - addressed in versions 8.2.5038-150000.5.21.1, 9.0.0814-17.9.1
vim-debuginfo - addressed in versions 8.2.5038-150000.5.21.1, 9.0.0814-17.9.1
vim-debugsource - addressed in versions 8.2.5038-150000.5.21.1, 9.0.0814-17.9.1
vim-small - update to 8.2.5038-150000.5.21.1
vim-small-debuginfo - update to 8.2.5038-150000.5.21.1
vim-data-common - addressed in versions 8.2.5038-150000.5.21.1, 9.0.0814-17.9.1
app-editors/vim - addressed in versions 9.0.0060, 9.0.1157
app-editors/gvim - addressed in versions 9.0.0060, 9.0.1157
app-editors/vim-core - addressed in versions 9.0.0060, 9.0.1157
vim - update to 9.0.1160-1.1
macOS - update to 13.0 22A380
EMC Cloud Tiering Appliance - update to 13.1.0.2.29

External References

Related Security Bulletins