Moderate: vim security update
Summary
RLSA-2022:5319: Moderate: vim security update. Affects vim versions < 2:8.0.1763-19.el8_6.2. Fixed in 2:8.0.1763-19.el8_6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim (Vi IMproved) is an updated and improved version of the vi editor. It is a highly configurable text editor built to enable efficient text editing. Vim is widely used by developers and system administrators for various programming tasks and system configurations. The package 'vim' in Rocky Linux version 8 is affected by a moderate security vulnerability.
Vulnerability Detail
The vulnerability identified as CVE-2022-1621 is a heap buffer overflow in Vim. This vulnerability allows an attacker to overwrite adjacent memory locations, potentially leading to arbitrary code execution or a system crash. The second vulnerability, CVE-2022-1629, is a buffer over-read issue in Vim. This flaw could be exploited by an attacker to read sensitive information from the memory, potentially leading to information disclosure. Both vulnerabilities have a CVSS score of 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
2:8.0.1763-19.el8_6.2
This is the first release that contains the fix.
sudo dnf update vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Vim in Rocky Linux version 8 is affected by two moderate security vulnerabilities. It is crucial to update the package to the recommended version to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for vim →
FAQ
Vim is an enhanced version of the vi editor, designed for efficient text editing and widely used by developers and system administrators.
CVE-2022-1621 allows an attacker to execute arbitrary code or crash the system by exploiting a heap buffer overflow vulnerability in Vim.
CVE-2022-1629 enables an attacker to read sensitive information from memory by exploiting a buffer over-read vulnerability in Vim.
Both vulnerabilities have a CVSS score of 7.8, indicating a high severity level.
To update Vim in Rocky Linux version 8, you can use the command 'sudo dnf update vim' to install the latest version of the package.
Related vulnerabilities
Recent vulnerabilities recorded for vim.
