Moderate: vim security update
Summary
RLSA-2022:5813: Moderate: vim security update. Affects vim versions < 2:8.0.1763-19.el8_6.4. Fixed in 2:8.0.1763-19.el8_6.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim (Vi IMproved) is an updated and improved version of the vi editor. It is widely used for text editing and programming tasks. Vim provides various features and enhancements over the traditional vi editor, making it a popular choice among developers and system administrators.
Vulnerability Detail
The vulnerability (CVE-2022-1785) in Vim is an out-of-bounds write issue. This vulnerability could be exploited by an attacker to write data outside the bounds of an allocated buffer, potentially leading to a crash or arbitrary code execution. Another vulnerability (CVE-2022-1897) in Vim allows an out-of-bounds write in vim_regsub_both() function in regexp.c, which could also result in arbitrary code execution. Additionally, there is a buffer over-read vulnerability (CVE-2022-1927) in utf_ptr2char() function in mbyte.c, which could lead to information disclosure or a crash. These vulnerabilities have a CVSS score of 7.8, indicating a moderate severity level.
How To Fix
Minimum fixed version
2:8.0.1763-19.el8_6.4
This is the first release that contains the fix.
sudo dnf update vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, Vim is affected by multiple vulnerabilities that could potentially lead to arbitrary code execution, crashes, or information disclosure. It is crucial to update the Vim package to the latest version to mitigate these risks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vim →
FAQ
Vim is an improved version of the vi editor, providing enhanced features and functionality for text editing and programming tasks.
These vulnerabilities could potentially allow an attacker to execute arbitrary code, crash the application, or disclose sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Simply upload your package manifest file (e.g., package-lock.json) and Vulert will provide real-time alerts for any open-source vulnerabilities.
At the moment, there are no known workarounds for these vulnerabilities. It is recommended to update the Vim package to the latest version as soon as possible.
These vulnerabilities were discovered and reported by the Rocky Enterprise Software Foundation and Red Hat.
References
Related vulnerabilities
Recent vulnerabilities recorded for vim.
