Use After Free Vulnerability in vim
Summary
CVE-2021-4173: vim is vulnerable to Use After Free. Affects vim versions < 8.2.4173-r0. Fixed in 8.2.4173-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
vim is a popular text editor that is widely used for editing files in various programming languages. It provides a range of features and functionalities to enhance the editing experience. However, the vim package in Alpine Linux versions 3.12 to 3.18 is vulnerable to a Use After Free vulnerability.
Vulnerability Detail
The Use After Free vulnerability in vim allows an attacker to exploit a memory corruption issue. By manipulating certain memory objects after they have been freed, an attacker can potentially execute arbitrary code or cause a denial of service. This vulnerability has a CVSS score of 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
8.2.4173-r0
This is the first release that contains the fix.
sudo apk add --upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by updating the vim package.
Conclusion
The Use After Free vulnerability in vim can have severe consequences, including arbitrary code execution and denial of service. It is crucial to update the vim package to the fixed version to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for vim →
FAQ
This vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial of service.
Alpine Linux versions 3.12 to 3.18 are affected by this vulnerability.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
No, there is no known workaround. It is crucial to update the vim package to the fixed version.
You can find more information about this vulnerability in the CVE-2021-4173.json file available at the following source: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-4173.json
Related vulnerabilities
Recent vulnerabilities recorded for vim.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
