Heap-based Buffer Overflow in vim/vim
Summary
CVE-2022-0361: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Affects vim versions < 8.2.4619-r0. Fixed in 8.2.4619-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vim is a highly configurable text editor built to enable efficient text editing. It is widely used in various operating systems and offers a range of features for developers and users. However, a vulnerability has been discovered in versions prior to 8.2, which allows for a heap-based buffer overflow.
Vulnerability Detail
The vulnerability, identified as CVE-2022-0361, originates from a heap-based buffer overflow in the GitHub repository vim/vim. This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial of service. The severity of this vulnerability is rated as high, with a CVSS score of 7.8. It affects multiple versions of the vim package in the Alpine Linux ecosystem.
How To Fix
Minimum fixed version
8.2.4619-r0
This is the first release that contains the fix.
sudo apk add --upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is crucial to apply the recommended fix by updating the vim package to the patched version.
Conclusion
In conclusion, the heap-based buffer overflow vulnerability in the vim/vim repository can lead to arbitrary code execution or denial of service. It is crucial for users to update their vim packages to version 8.2.4619-r0 or later to mitigate this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vim →
FAQ
This vulnerability can allow an attacker to execute arbitrary code or cause a denial of service on systems running vulnerable versions of the vim package.
The vulnerability affects versions prior to 8.2 of the vim package in the Alpine Linux ecosystem.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package manifest file, such as package-lock.json, and the tool will provide real-time alerts for open-source vulnerabilities.
At the time of this report, there are no known public exploits for this vulnerability. However, it is crucial to apply the recommended fix to mitigate any potential risks.
You can find more detailed information about this vulnerability, including the technical aspects and its impact, in the official CVE-2022-0361 report at https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-0361.json.
Related vulnerabilities
Recent vulnerabilities recorded for vim.
