ALAS2-2023-1975 — Important: vim security update (Amazon Linux 2)

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0512: Divide By Zero in GitHub repository vim/vim prior to 9.0.1247. CVE-2023-0433: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225. CVE-2023-0288: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. CVE-2023-0054: Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. CVE-2023-0051: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. CVE-2022-47024: A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thru 9.0.0339 allows attackers to cause denial of service or other unspecified impacts. CVE-2022-3491: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742. CVE-2022-3352: Use After Free in GitHub repository vim/vim prior to 9.0.0614. CVE-2022-3324: Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598. CVE-2022-3297: Use After Free in GitHub repository vim/vim prior to 9.0.0579. CVE-2022-3296: Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577. CVE-2022-3278: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552. CVE-2022-3256: Use After Free in GitHub repository vim/vim prior to 9.0.0530. CVE-2022-3235: Use After Free in GitHub repository vim/vim prior to 9.0.0490. CVE-2022-3234: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483. CVE-2022-3153: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. CVE-2022-3134: A heap use-after-free vulnerability was found in vim's do_tag() function of the src/tag.c file. The issue triggers when the 'tagfunc' closes the window. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering a heap use-after-free that causes an application to crash, possibly executing code and corrupting memory. CVE-2022-2874: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224. CVE-2022-2581: A flaw was found in vim. The vulnerability occurs due to illegal memory access and leads to a heap buffer overflow. This flaw allows an attacker to input a specially crafted file, leading to a crash or code execution. CVE-2022-2580: A flaw was found in vim. The vulnerability occurs due to illegal memory access and leads to a heap buffer overflow. This flaw allows an attacker to input a specially crafted file, leading to a crash or code execution. CVE-2022-2571: A flaw was found in vim. The vulnerability occurs due to illegal memory access and leads to a heap buffer overflow vulnerability. This flaw allows an attacker to input a specially crafted file, leading to a crash or code execution. CVE-2022-2522: A heap buffer overflow vulnerability was found in vim's ins_compl_infercase_gettext() function of the src/insexpand.c file. This flaw occurs when vim tries to access uninitialized memory when completing a long line. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering a heap-based buffer overflow that causes an application to crash, possibly executing code and corrupting memory.

Fixed packages 7

Release	Package	Fixed in
Amazon Linux · 2	vim-common	2:9.0.1314-1.amzn2.0.1
Amazon Linux · 2	vim-data	2:9.0.1314-1.amzn2.0.1
Amazon Linux · 2	vim-debuginfo	2:9.0.1314-1.amzn2.0.1
Amazon Linux · 2	vim-enhanced	2:9.0.1314-1.amzn2.0.1
Amazon Linux · 2	vim-filesystem	2:9.0.1314-1.amzn2.0.1
Amazon Linux · 2	vim-minimal	2:9.0.1314-1.amzn2.0.1
Amazon Linux · 2	vim-X11	2:9.0.1314-1.amzn2.0.1

Vulnerabilities 22

High 7.8

CVE-2022-2522

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061.

vim vim/vim vim vim Debian Ubuntu Azure Linux

Jul 25, 2022
High 7.8

CVE-2022-2571

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0101.

vim vim/vim vim vim Debian Ubuntu Azure Linux

Aug 1, 2022
High 7.8

CVE-2022-2581

Out-of-bounds Read in vim/vim

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0104.

vim vim/vim vim vim Debian Ubuntu Azure Linux

Aug 1, 2022
High 7.8

CVE-2022-3134

Use After Free in vim/vim

Use After Free in GitHub repository vim/vim prior to 9.0.0389.

vim vim/vim vim vim Debian Ubuntu Azure Linux Alpine

Sep 6, 2022
High 7.8

CVE-2022-3234

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483.

vim vim/vim vim vim Debian Ubuntu Azure Linux Alpine

Sep 17, 2022
High 7.8

CVE-2022-3235

Use After Free in vim/vim

Use After Free in GitHub repository vim/vim prior to 9.0.0490.

vim vim/vim vim vim Debian Ubuntu Azure Linux Alpine

Sep 18, 2022
High 7.8

CVE-2022-3256

Use After Free in vim/vim

Use After Free in GitHub repository vim/vim prior to 9.0.0530.

vim vim/vim vim vim Debian Ubuntu Azure Linux Alpine

Sep 22, 2022
High 7.8

CVE-2022-3296

Stack-based Buffer Overflow in vim/vim

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577.

vim vim/vim vim vim Debian Ubuntu Azure Linux

Sep 25, 2022
High 7.8

CVE-2022-3297

Use After Free in vim/vim

Use After Free in GitHub repository vim/vim prior to 9.0.0579.

vim vim/vim vim vim Debian Ubuntu Azure Linux

Sep 25, 2022
High 7.8

CVE-2022-3324

Stack-based Buffer Overflow in vim/vim

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598.

vim vim/vim vim vim Debian Ubuntu Azure Linux

Sep 27, 2022
High 7.8

CVE-2022-3352

Use After Free in vim/vim

Use After Free in GitHub repository vim/vim prior to 9.0.0614.

vim vim/vim vim vim Debian Ubuntu Azure Linux Alpine

Sep 29, 2022
High 7.8

CVE-2022-47024

A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thr…

vim vim vim Debian Ubuntu Alpine

Jan 20, 2023
High 7.8

CVE-2023-0433

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225.

vim vim/vim vim vim Debian Ubuntu Azure Linux Alpine

Jan 21, 2023
High 7.3

CVE-2022-2580

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0102.

vim vim/vim vim vim Ubuntu Azure Linux

Aug 1, 2022
High 7.3

CVE-2023-0051

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.

vim vim/vim vim vim Debian Ubuntu Azure Linux Alpine

Jan 4, 2023
High 7.3

CVE-2023-0054

Out-of-bounds Write in vim/vim

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145.

vim vim/vim vim vim Debian Ubuntu Azure Linux Alpine

Jan 4, 2023
High 7.3

CVE-2023-0288

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189.

vim vim/vim vim vim Debian Ubuntu Azure Linux Alpine

Jan 13, 2023
High 7.3

CVE-2023-0512

Divide By Zero in vim/vim

Divide By Zero in GitHub repository vim/vim prior to 9.0.1247.

vim vim/vim vim vim Debian Azure Linux Alpine

Jan 26, 2023
Medium 6.8

CVE-2022-3278

NULL Pointer Dereference in vim/vim

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552.

vim vim/vim vim vim Debian Ubuntu Azure Linux Alpine

Sep 23, 2022
Medium 6.6

CVE-2022-2874

NULL Pointer Dereference in vim/vim

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224.

vim vim/vim vim vim Debian Ubuntu Azure Linux

Aug 18, 2022
Medium 6.1

CVE-2022-3153

NULL Pointer Dereference in vim/vim

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.

vim vim/vim vim vim Debian Ubuntu Azure Linux

Sep 8, 2022
Medium 4.0

CVE-2022-3491

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742.

vim vim/vim vim vim Debian Ubuntu

Dec 3, 2022

References

web
https://alas.aws.amazon.com/cve/html/CVE-2022-2522.html
web
https://alas.aws.amazon.com/cve/html/CVE-2022-2571.html
web
https://alas.aws.amazon.com/cve/html/CVE-2022-2580.html
web
https://alas.aws.amazon.com/cve/html/CVE-2022-2581.html
web
https://alas.aws.amazon.com/cve/html/CVE-2022-2874.html
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3134.html
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3153.html
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3234.html
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3235.html
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3256.html
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3278.html
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3296.html
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3297.html
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3324.html
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3352.html
web
https://alas.aws.amazon.com/cve/html/CVE-2022-3491.html
web
https://alas.aws.amazon.com/cve/html/CVE-2022-47024.html
web
https://alas.aws.amazon.com/cve/html/CVE-2023-0051.html
web
https://alas.aws.amazon.com/cve/html/CVE-2023-0054.html
web
https://alas.aws.amazon.com/cve/html/CVE-2023-0288.html
web
https://alas.aws.amazon.com/cve/html/CVE-2023-0433.html
web
https://alas.aws.amazon.com/cve/html/CVE-2023-0512.html

Important: vim security update (Amazon Linux 2)

Summary

Fixed packages 7

Vulnerabilities 22

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in vim/vim

Out-of-bounds Read in vim/vim

Use After Free in vim/vim

Heap-based Buffer Overflow in vim/vim

Use After Free in vim/vim

Use After Free in vim/vim

Stack-based Buffer Overflow in vim/vim

Use After Free in vim/vim

Stack-based Buffer Overflow in vim/vim

Use After Free in vim/vim

A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thr…

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in vim/vim

Out-of-bounds Write in vim/vim

Heap-based Buffer Overflow in vim/vim

Divide By Zero in vim/vim

NULL Pointer Dereference in vim/vim

NULL Pointer Dereference in vim/vim

NULL Pointer Dereference in vim/vim

Heap-based Buffer Overflow in vim/vim

References