Summary
It was discovered that Vim incorrectly handled parsing of filenames in its
search functionality. If a user were tricked into opening a specially crafted
file, an attacker could crash the application, leading to a denial of
service. (CVE-2021-3973)
It was discovered that Vim incorrectly handled memory when opening and
searching the contents of certain files. If a user were tricked into opening
a specially crafted file, an attacker could crash the application, leading to
a denial of service, or possibly achieve code execution with user privileges.
(CVE-2021-3974)
It was discovered that Vim incorrectly handled memory when opening and editing
certain files. If a user were tricked into opening a specially crafted file,
an attacker could crash the application, leading to a denial of service, or
possibly achieve code execution with user privileges. (CVE-2021-3984,
CVE-2021-4019, CVE-2021-4069)
It was discovered that Vim was using freed memory when dealing with regular
expressions inside a visual selection. If a user were tricked into opening a
specially crafted file, an attacker could crash the application, leading to a
denial of service, or possibly achieve code execution with user privileges.
(CVE-2021-4192)
It was discovered that Vim was incorrectly performing read and write
operations when in visual block mode, going beyond the end of a line and
causing a heap buffer overflow. If a user were tricked into opening a
specially crafted file, an attacker could crash the application, leading to a
denial of service, or possibly achieve code execution with user privileges.
(CVE-2022-0261, CVE-2022-0318)
It was discovered that Vim was using freed memory when dealing with regular
expressions through its old regular expression engine. If a user were tricked
into opening a specially crafted file, an attacker could crash the application,
leading to a denial of service, or possibly achieve code execution with user
privileges. (CVE-2022-1154)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | vim | 2:7.4.1689-3ubuntu1.5+esm4 |
Vulnerabilities 9
-
High 7.8
Use after free in utf_ptr2char in vim/vim
Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.
-
High 7.3
Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
-
High 7.3
Use After Free in vim/vim
vim is vulnerable to Use After Free
-
High 7.3
Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
-
High 7.3
Use After Free in vim/vim
vim is vulnerable to Use After Free
-
High 7.1
Heap-based Buffer Overflow in vim/vim
vim is vulnerable to Heap-based Buffer Overflow
-
Medium 6.6
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in vim/vim prior to 8.2.
-
Medium 5.5
Use After Free in vim/vim
vim is vulnerable to Use After Free
-
Unscored —
Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
References
-
report
https://ubuntu.com/security/CVE-2021-3973
-
report
https://ubuntu.com/security/CVE-2021-3974
-
report
https://ubuntu.com/security/CVE-2021-3984
-
report
https://ubuntu.com/security/CVE-2021-4019
-
report
https://ubuntu.com/security/CVE-2021-4069
-
report
https://ubuntu.com/security/CVE-2021-4192
-
report
https://ubuntu.com/security/CVE-2022-0261
-
report
https://ubuntu.com/security/CVE-2022-0318
-
report
https://ubuntu.com/security/CVE-2022-1154