Critical NULL Pointer Dereference Vulnerability in Vim Package
Summary
UBUNTU-CVE-2022-2874: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224. Affects vim versions < 2:8.2.3995-1ubuntu2.11. Fixed in 2:8.2.3995-1ubuntu2.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is a highly configurable text editor built to enable efficient text editing. It is widely used by developers and system administrators for its powerful features and extensibility. The specific vulnerability in question affects multiple versions of Vim, including vim, vim-athena, vim-common, vim-gtk, vim-gtk3, vim-gui-common, vim-nox, vim-runtime, vim-tiny, and xxd, all of which are part of the Ubuntu 22.04 LTS ecosystem.
Vulnerability Detail
The vulnerability identified as CVE-2022-2874 is a NULL Pointer Dereference that occurs in the Vim text editor prior to version 9.0.0224. This flaw can lead to application crashes and potentially allow an attacker to exploit the system by causing unexpected behavior. The vulnerability arises from improper handling of certain inputs, which can result in a crash when the affected version of Vim is executed with maliciously crafted data.
How To Fix
Minimum fixed version
2:8.2.3995-1ubuntu2.11
This is the first release that contains the fix.
sudo apt-get install --only-upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected features of Vim until the package is updated. It is advisable to refrain from opening files that may contain malicious content until the patch is applied.
Conclusion
The NULL Pointer Dereference vulnerability in Vim (CVE-2022-2874) poses a significant risk to users of the affected versions. It is crucial to update to the patched version to mitigate potential risks. Users can also leverage tools like Vulert to monitor for vulnerabilities in their software.
See every vulnerability recorded for vim →
FAQ
CVE-2022-2874 is a NULL Pointer Dereference vulnerability found in the Vim text editor that can lead to application crashes.
You can check your version of Vim by running 'vim --version' in the terminal. If it is below 2:8.2.3995-1ubuntu2.11, it is affected.
The vulnerability can lead to application crashes and may allow attackers to exploit the system through unexpected behavior.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for vim.
