#VU66633 Heap-based buffer overflow in Vim - CVE-2022-2598
Vulnerability identifier: #VU66633
Vulnerability risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-122
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Vim
Client/Desktop applications /
Software for system administration
Vendor: Vim.org
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the diff_write_buffer() function in diff.c. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and crash the application.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Vim: 9.0.0000, 9.0.0001, 9.0.0002, 9.0.0003, 9.0.0004, 9.0.0005, 9.0.0006, 9.0.0007, 9.0.0008, 9.0.0009, 9.0.0010, 9.0.0011, 9.0.0012, 9.0.0013, 9.0.0014, 9.0.0015, 9.0.0016, 9.0.0017, 9.0.0018, 9.0.0019, 9.0.0020, 9.0.0021, 9.0.0022, 9.0.0023, 9.0.0024, 9.0.0025, 9.0.0026, 9.0.0027, 9.0.0028, 9.0.0029, 9.0.0030, 9.0.0031, 9.0.0032, 9.0.0033, 9.0.0034, 9.0.0035, 9.0.0036, 9.0.0037, 9.0.0038, 9.0.0039, 9.0.0040, 9.0.0041, 9.0.0042, 9.0.0043, 9.0.0044, 9.0.0045, 9.0.0046, 9.0.0047, 9.0.0048, 9.0.0049, 9.0.0050, 9.0.0051, 9.0.0052, 9.0.0053, 9.0.0054, 9.0.0055, 9.0.0056, 9.0.0057, 9.0.0058, 9.0.0059, 9.0.0060, 9.0.0061, 9.0.0062, 9.0.0063, 9.0.0064, 9.0.0065, 9.0.0066, 9.0.0067, 9.0.0068, 9.0.0069, 9.0.0070, 9.0.0071, 9.0.0072, 9.0.0073, 9.0.0074, 9.0.0075, 9.0.0076, 9.0.0077, 9.0.0078, 9.0.0079, 9.0.0080, 9.0.0081, 9.0.0082, 9.0.0083, 9.0.0084, 9.0.0085, 9.0.0086, 9.0.0087, 9.0.0088, 9.0.0089, 9.0.0090, 9.0.0091, 9.0.0092, 9.0.0093, 9.0.0094, 9.0.0095, 9.0.0096, 9.0.0097, 9.0.0098, 9.0.0099
External links
https://github.com/vim/vim/commit/4e677b9c40ccbc5f090971b31dc2fe07bf05541d
https://huntr.dev/bounties/2f08363a-47a2-422d-a7de-ce96a89ad08e
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
