NULL pointer dereference in Vim - CVE-2022-47024

Vulnerability identifier: #VU71559

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-47024

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the gui_x11_create_blank_mouse(0 function in gui_x11.c. A remote attacker can perform a denial of service (DoS) attack.

Vim
Isolation Segment
VMware Tanzu Application Service for VMs
Red Hat OpenShift Dev Spaces
Amazon Linux AMI
Gentoo Linux
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Ubuntu
openEuler
Fedora
Red Hat OpenShift Container Platform
vim-gtk-py2 (Ubuntu package)
vim-gtk3 (Ubuntu package)
vim (Ubuntu package)
vim-nox (Ubuntu package)
vim-gtk (Ubuntu package)
vim-nox-py2 (Ubuntu package)
vim-athena-py2 (Ubuntu package)
vim-tiny (Ubuntu package)
vim-gtk3-py2 (Ubuntu package)
vim-athena (Ubuntu package)
vim
vim (Red Hat package)
vim-filesystem
vim-debuginfo
vim-common
vim-X11
vim-enhanced
vim-minimal
vim-debugsource
app-editors/gvim
app-editors/vim-core
app-editors/vim
cflinuxfs3
OpenShift Service Mesh
VMware Tanzu Operations Manager
OpenShift Data Foundation (formerly OpenShift Container Storage)

Install update from vendor's website.

Vim - update to 9.0.0339
Red Hat OpenShift Container Platform - update to 4.13.2
vim-gtk-py2 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2:8.0.1453-1ubuntu1.11, 2:8.1.2269-1ubuntu5.12, 2:8.2.3995-1ubuntu2.4, 2:9.0.0242-1ubuntu1.2
vim (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2:8.0.1453-1ubuntu1.11, 2:8.1.2269-1ubuntu5.12, 2:8.2.3995-1ubuntu2.4, 2:9.0.0242-1ubuntu1.2
vim-nox (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2:8.0.1453-1ubuntu1.11, 2:8.1.2269-1ubuntu5.12, 2:8.2.3995-1ubuntu2.4, 2:9.0.0242-1ubuntu1.2
vim-gtk (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2:8.0.1453-1ubuntu1.11, 2:8.1.2269-1ubuntu5.12, 2:8.2.3995-1ubuntu2.4
vim-nox-py2 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
vim-athena-py2 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
vim-tiny (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2:8.0.1453-1ubuntu1.11, 2:8.1.2269-1ubuntu5.12, 2:8.2.3995-1ubuntu2.4, 2:9.0.0242-1ubuntu1.2
vim-gtk3-py2 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2:8.0.1453-1ubuntu1.11, 2:8.1.2269-1ubuntu5.12, 2:8.2.3995-1ubuntu2.4, 2:9.0.0242-1ubuntu1.2
vim - addressed in versions stable-3720230209142410.1, 9.0.1293-1.fc36, 9.0.1293-1.fc37, 9.0.1307-1.fc36
cflinuxfs3 - update to 0.357.0
OpenShift Service Mesh - update to 2.5.2
VMware Tanzu Operations Manager - addressed in versions 2.10.53, 2.10.57, 3.0.6
Red Hat OpenShift Dev Spaces - update to 3.16.0
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.13.0
vim (Red Hat package) - update to 8.2.2637-20.el9_1
vim-filesystem - update to 9.0-7
vim-debuginfo - update to 9.0-7
vim-common - update to 9.0-7
vim-X11 - update to 9.0-7
vim-enhanced - update to 9.0-7
vim-minimal - update to 9.0-7
vim-debugsource - update to 9.0-7
vim - update to 9.0-7
app-editors/gvim - update to 9.0.1157
app-editors/vim-core - update to 9.0.1157
app-editors/vim - update to 9.0.1157
vim - addressed in versions 9.0.1314-1, 9.0.1403-1.76

• https://github.com/vim/vim/commit/a63ad78ed31e36dbdf3a9cd28071dcdbefce7d19

• Denial of service in Vim
• Ubuntu update for vim
• Red Hat Enterprise Linux 9 update for vim
• Ubuntu update for vim
• Multiple vulnerabilities in Cloud Foundry Foundation cflinuxfs3
• Amazon Linux AMI update for vim
• Gentoo update for Vim, gVim
• VMware Tanzu products update for Vim
• VMware Tanzu products update for Vim
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• Fedora 37 update for vim
• Fedora 36 update for vim
• Fedora 37 Flatpaks update for vim
• Fedora 36 update for vim
• Multiple vulnerabilities in Red Hat OpenShift Container Platform release 4.13
• openEuler update for vim
• Multiple vulnerabilities in OpenShift Service Mesh 2.5
• Amazon Linux AMI update for vim
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces