Heap-based Buffer Overflow Vulnerability in vim
Summary
CVE-2021-4019: vim is vulnerable to Heap-based Buffer Overflow. Affects vim versions < 8.2.3779-r0. Fixed in 8.2.3779-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vim is a highly popular text editor known for its extensive features and customization options. It is widely used by developers and system administrators for editing code and configuration files. However, the vim package in Alpine Linux versions 3.12 to 3.18 is vulnerable to a heap-based buffer overflow.
Vulnerability Detail
The vulnerability (CVE-2021-4019) in vim allows an attacker to overflow the heap-based buffer, potentially leading to remote code execution or denial of service. This can be exploited by crafting a specially crafted file or by tricking a user into opening a malicious file with vim. The vulnerability has a CVSS score of 7.8, indicating a high severity.
How To Fix
Minimum fixed version
8.2.3779-r0
This is the first release that contains the fix.
sudo apk add --upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the fix by updating the vim package to the patched version.
Conclusion
The heap-based buffer overflow vulnerability in vim poses a significant risk to systems running the affected versions of Alpine Linux. It is crucial to update the vim package to the patched version (8.2.3779-r0 or later) to mitigate the vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vim →
FAQ
The vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial of service on systems running the vulnerable version of vim.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package manifest file (e.g., package-lock.json) to the playground and it will analyze and alert you if the vulnerability is present.
No, only the vim package in Alpine Linux versions 3.12 to 3.18 is affected. Other distributions or versions may not be vulnerable to this specific issue.
At the time of this report, there is no known public exploit for this vulnerability. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
You can find more information about this vulnerability, including technical details and the fix, in the official CVE-2021-4019 JSON report at https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-4019.json.
Related vulnerabilities
Recent vulnerabilities recorded for vim.
