Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-4141: The target's backtrace indicates that libc has detected a heap error or that the target was executing a heap function when it stopped. This could be due to heap corruption, passing a bad pointer to a heap function such as free(), etc. Since heap errors might include buffer overflows, use-after-free situations, etc. they are generally considered exploitable.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | vim-common | 2:9.0.1006-1.amzn2.0.1 |
| Amazon Linux · 2 | vim-data | 2:9.0.1006-1.amzn2.0.1 |
| Amazon Linux · 2 | vim-debuginfo | 2:9.0.1006-1.amzn2.0.1 |
| Amazon Linux · 2 | vim-enhanced | 2:9.0.1006-1.amzn2.0.1 |
| Amazon Linux · 2 | vim-filesystem | 2:9.0.1006-1.amzn2.0.1 |
| Amazon Linux · 2 | vim-minimal | 2:9.0.1006-1.amzn2.0.1 |
| Amazon Linux · 2 | vim-X11 | 2:9.0.1006-1.amzn2.0.1 |
Vulnerabilities 1
-
High 7.3
Heap-based Buffer Overflow in vim/vim
Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-4141.html