Critical Use After Free Vulnerability in Vim Package
Summary
UBUNTU-CVE-2022-3099: Use After Free in GitHub repository vim/vim prior to 9.0.0360. Affects vim versions < 2:7.4.052-1ubuntu3.1+esm12. Fixed in 2:7.4.052-1ubuntu3.1+esm12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is a highly configurable text editor built to enable efficient text editing. It is widely used by developers and system administrators for its powerful features and extensibility. The package is available in various versions across different Ubuntu distributions, including Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and more. This vulnerability affects multiple versions of Vim, making it crucial for users to update to the latest patched versions to ensure security.
Vulnerability Detail
The vulnerability identified as CVE-2022-3099 is a Use After Free issue in the Vim package, which can lead to potential arbitrary code execution. This vulnerability arises from improper handling of memory, allowing an attacker to exploit the flaw and execute malicious code. The severity of this vulnerability is rated at a CVSS score of 7.8, indicating a high risk to affected systems. Users are advised to take immediate action to mitigate the risks associated with this vulnerability.
How To Fix
Minimum fixed version
2:7.4.052-1ubuntu3.1+esm12
This is the first release that contains the fix.
sudo apt-get install --only-upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable certain features of Vim that may be exploited until they can apply the patch. However, the best course of action is to update to the patched version as soon as possible.
Conclusion
The Use After Free vulnerability in the Vim package (CVE-2022-3099) poses a significant risk to users across multiple Ubuntu distributions. It is essential to update to the latest patched versions to mitigate potential security threats. Users are encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their software.
See every vulnerability recorded for vim →
FAQ
CVE-2022-3099 is a Use After Free vulnerability in the Vim package that can lead to arbitrary code execution.
You can check your version of Vim by running 'vim --version' in the terminal. Compare it with the patched versions listed in the 'how to fix' section.
If you cannot update Vim immediately, consider disabling features that may be vulnerable or using an alternative text editor until the update can be applied.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for vim.
