Critical Use After Free Vulnerability in Vim Package
Summary
UBUNTU-CVE-2022-3591: Use After Free in GitHub repository vim/vim prior to 9.0.0789. Affects vim versions < 2:7.4.052-1ubuntu3.1+esm13. Fixed in 2:7.4.052-1ubuntu3.1+esm13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is a highly configurable text editor built to enable efficient text editing. It is widely used by developers and system administrators for its powerful features and extensibility. The Vim package is available on various Linux distributions, including Ubuntu, and is known for its versatility in handling different file types and programming languages. However, recent vulnerabilities have raised concerns about its security, particularly a critical use-after-free vulnerability that could allow attackers to execute arbitrary code.
Vulnerability Detail
The vulnerability, identified as CVE-2022-3591, originates from a use-after-free condition in the Vim codebase prior to version 9.0.0789. This flaw can be exploited by an attacker to manipulate memory, potentially leading to arbitrary code execution. The ramifications of this vulnerability are severe, as it could allow unauthorized access to sensitive data or system control. The CVSS score for this vulnerability is 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
2:7.4.052-1ubuntu3.1+esm13
This is the first release that contains the fix.
sudo apt-get install --only-upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid opening untrusted files or disabling certain Vim features that may trigger the vulnerability. However, the best course of action is to apply the patch as soon as possible.
Conclusion
The CVE-2022-3591 vulnerability in the Vim package poses a significant risk due to its potential for arbitrary code execution. Users are strongly advised to update their Vim installations to the latest patched versions to mitigate this risk. Additionally, temporary workarounds can be employed until the update is applied.
See every vulnerability recorded for vim →
FAQ
CVE-2022-3591 is a critical use-after-free vulnerability found in the Vim text editor that can lead to arbitrary code execution.
You can check your Vim version using the command 'vim --version' in the terminal. Compare it with the patched versions listed in the 'how_to_fix' section.
If an immediate update is not possible, refrain from opening untrusted files in Vim and consider disabling features that may exploit this vulnerability.
Detailed information can be found in the Ubuntu security notices and the official CVE database.
Vulert allows users to monitor and alert in real-time for open-source vulnerabilities using just a manifest file like package-lock.json, without needing access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for vim.
