Out-of-bounds Read in vim/vim
Summary
CVE-2022-0393: Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. Affects vim versions < 8.2.4619-r0. Fixed in 8.2.4619-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vim is a popular text editor that is widely used for editing code and text files. It provides various features and functionalities to enhance the editing experience. However, prior to version 8.2, vim/vim is vulnerable to an out-of-bounds read vulnerability.
Vulnerability Detail
The out-of-bounds read vulnerability in vim/vim allows an attacker to read data from memory locations outside the bounds of an allocated buffer. This can lead to information disclosure or potential crashes. The vulnerability originates from a flaw in the code implementation and can be exploited by an attacker with local access to the system. The CVSS score for this vulnerability is 7.1, indicating a high severity.
How To Fix
Minimum fixed version
8.2.4619-r0
This is the first release that contains the fix.
sudo apk add --upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of vim/vim to mitigate the risk.
Conclusion
The out-of-bounds read vulnerability in vim/vim prior to version 8.2 can potentially lead to information disclosure or crashes. It is crucial to update to the fixed version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vim →
FAQ
The vulnerability can potentially allow an attacker to read sensitive information from memory or cause the application to crash, leading to a denial of service.
Users of vim/vim versions prior to 8.2 are affected by this vulnerability. It primarily affects systems where the vulnerable version of vim/vim is installed.
No, this vulnerability requires local access to the system to exploit. Remote exploitation is not possible.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
Yes, you can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. It provides real-time monitoring and alerts for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for vim.
