Summary
Vim (Vi IMproved) is an updated and improved version of the vi editor.
Security Fix(es):
* vim: Use of Out-of-range Pointer Offset in vim (CVE-2022-0554)
* vim: Heap-based Buffer Overflow occurs in vim (CVE-2022-0943)
* vim: Out-of-range Pointer Offset (CVE-2022-1420)
* vim: heap buffer overflow (CVE-2022-1621)
* vim: buffer over-read (CVE-2022-1629)
* vim: use after free in utf_ptr2char (CVE-2022-1154)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | vim-common | 2:8.2.2637-16.el9_0.2 |
| AlmaLinux · 9 | vim-enhanced | 2:8.2.2637-16.el9_0.2 |
| AlmaLinux · 9 | vim-filesystem | 2:8.2.2637-16.el9_0.2 |
| AlmaLinux · 9 | vim-minimal | 2:8.2.2637-16.el9_0.2 |
| AlmaLinux · 9 | vim-X11 | 2:8.2.2637-16.el9_0.2 |
Vulnerabilities 6
-
High 8.4
Use of Out-of-range Pointer Offset in vim/vim
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.
-
High 8.4
Heap-based Buffer Overflow occurs in vim in vim/vim
Heap-based Buffer Overflow occurs in vim in GitHub repository vim/vim prior to 8.2.4563.
-
High 7.8
Use after free in utf_ptr2char in vim/vim
Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.
-
High 7.3
Heap buffer overflow in vim_strncpy find_word in vim/vim
Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
-
Medium 6.8
Use of Out-of-range Pointer Offset in vim/vim
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774.
-
Medium 6.6
Buffer Over-read in function find_next_quote in vim/vim
Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software, Modify Memory, and possible remote execution
References
-
report
https://access.redhat.com/security/cve/CVE-2022-0554
-
report
https://access.redhat.com/security/cve/CVE-2022-0943
-
report
https://access.redhat.com/security/cve/CVE-2022-1154
-
report
https://access.redhat.com/security/cve/CVE-2022-1420
-
report
https://access.redhat.com/security/cve/CVE-2022-1621
-
report
https://access.redhat.com/security/cve/CVE-2022-1629
-
report
https://bugzilla.redhat.com/2058483
-
report
https://bugzilla.redhat.com/2064064
-
report
https://bugzilla.redhat.com/2073013
-
report
https://bugzilla.redhat.com/2077734
-
report
https://bugzilla.redhat.com/2083924
-
report
https://bugzilla.redhat.com/2083931
-
advisory
https://errata.almalinux.org/9/ALSA-2022-5242.html