Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-0696: A NULL pointer dereference flaw was found in vim's find_ucmd() function of usercmd.c file. This flaw allows an attacker to trick a user into opening a crafted file, triggering a NULL pointer dereference. This issue leads to an application crash, causing a denial of service. CVE-2022-0685: A flaw was found in vim. The vulnerability occurs due to a crash when using a special multi-byte character and leads to an out-of-range vulnerability. This flaw allows an attacker to input a specially crafted file, leading to a crash or code execution. CVE-2022-0629: A stack-based buffer overflow flaw was found in vim's ga_concat_shorten_esc() function of src/testing.c file. This flaw allows an attacker to trick a user into opening a crafted file, triggering a stack-overflow. This issue can lead to an application crash, causing a denial of service. CVE-2022-0572: A heap-based buffer overflow flaw was found in vim's ex_retab() function of indent.c file. This flaw occurs when repeatedly using :retab. This flaw allows an attacker to trick a user into opening a crafted file triggering a heap-overflow. CVE-2022-0554: A flaw was found in vim that causes an out-of-range pointer offset vulnerability. This flaw allows an attacker to input a specially crafted file, leading to a crash or code execution.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | vim-common | 2:8.2.4428-1.amzn2.0.3 |
| Amazon Linux · 2 | vim-data | 2:8.2.4428-1.amzn2.0.3 |
| Amazon Linux · 2 | vim-debuginfo | 2:8.2.4428-1.amzn2.0.3 |
| Amazon Linux · 2 | vim-enhanced | 2:8.2.4428-1.amzn2.0.3 |
| Amazon Linux · 2 | vim-filesystem | 2:8.2.4428-1.amzn2.0.3 |
| Amazon Linux · 2 | vim-minimal | 2:8.2.4428-1.amzn2.0.3 |
| Amazon Linux · 2 | vim-X11 | 2:8.2.4428-1.amzn2.0.3 |
Vulnerabilities 5
-
High 8.4
Use of Out-of-range Pointer Offset in vim/vim
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.
-
High 8.4CVE-2022-0572 EPSS 26%
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
-
High 8.4
Stack-based Buffer Overflow in vim/vim
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
-
High 8.4
Use of Out-of-range Pointer Offset in vim/vim
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418.
-
Medium 6.2
NULL Pointer Dereference in vim/vim
NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4428.