OESA-2022-1668

Dashboard / Vulnerabilities / OESA-2022-1668

OESA-2022-1668

Summary: vim security update

Details: Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems. Security Fix(es): Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution.(CVE-2022-1619) NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash) via a crafted input.(CVE-2022-1620) Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution.(CVE-2022-1621) Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software, Modify Memory, and possible remote execution.(CVE-2022-1629) NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 allows attackers to cause a denial of service (application crash) via a crafted input.(CVE-2022-1674)

References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1668, https://nvd.nist.gov/vuln/detail/CVE-2022-1619, https://nvd.nist.gov/vuln/detail/CVE-2022-1620, https://nvd.nist.gov/vuln/detail/CVE-2022-1621, https://nvd.nist.gov/vuln/detail/CVE-2022-1629, https://nvd.nist.gov/vuln/detail/CVE-2022-1674