Out-of-bounds write in Vim - CVE-2021-3770

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU63062

Out-of-bounds write in Vim - CVE-2021-3770

Published: May 11, 2022


Vulnerability identifier: #VU63062
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-3770
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

Vim
Gentoo Linux
Amazon Linux AMI
Ubuntu
openEuler
Fedora
vim (Ubuntu package)
vim-enhanced
vim-filesystem
vim-minimal
vim-debugsource
vim-X11
vim-debuginfo
vim-common
vim
app-editors/vim-core
app-editors/vim
app-editors/gvim

How to mitigate CVE-2021-3770

Install updates from vendor's website.

Vim - update to 8.2.3402
vim (Ubuntu package) - addressed in versions 2:8.0.1453-1ubuntu1.6, 2:8.1.2269-1ubuntu5.3, 2:8.2.2434-1ubuntu1.1
vim-enhanced - update to 8.2-2
vim-filesystem - update to 8.2-2
vim-minimal - update to 8.2-2
vim-debugsource - update to 8.2-2
vim-X11 - update to 8.2-2
vim-debuginfo - update to 8.2-2
vim-common - update to 8.2-2
vim - update to 8.2-2
vim - addressed in versions 8.2.3404-1.fc33, 8.2.3404-1.fc34, 8.2.3404-1.fc35
app-editors/vim-core - update to 9.0.0060
app-editors/vim - update to 9.0.0060
app-editors/gvim - update to 9.0.0060
vim - update to 9.0.1160-1.1

External References

Related Security Bulletins