CVE-2022-0413

Use After Free in GitHub repository vim/vim prior to 8.2.

Use After Free in GitHub repository vim/vim prior to 8.2.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.(CVE-2022-0261)

Heap-based Buffer Overflow in vim/vim prior to 8.2.(CVE-2022-0318)

Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.(CVE-2022-0351)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.(CVE-2022-0359)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.(CVE-2022-0361)

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.(CVE-2022-0368)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.(CVE-2022-0392)

Use After Free in GitHub repository vim/vim prior to 8.2.(CVE-2022-0413)

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.(CVE-2022-0408)

Use After Free in Conda vim prior to 8.2.(CVE-2022-0443)

Heap-based Buffer Overflow in Conda vim prior to 8.2.(CVE-2022-0417)

vim is vulnerable to Heap-based Buffer Overflow(CVE-2022-0213)

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Heap-based buffer overflow in block_insert() in src/ops.c (CVE-2022-0261)

• vim: Heap-based buffer overflow in utf_head_off() in mbyte.c (CVE-2022-0318)

• vim: Heap-based buffer overflow in init_ccline() in ex_getln.c (CVE-2022-0359)

• vim: Illegal memory access when copying lines in visual mode leads to heap buffer overflow (CVE-2022-0361)

• vim: Heap-based buffer overflow in getexmodeline() in ex_getln.c (CVE-2022-0392)

• vim: Use after free in src/ex_cmds.c (CVE-2022-0413)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Use After Free in GitHub repository vim/vim prior to 8.2.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Heap-based buffer overflow in block_insert() in src/ops.c (CVE-2022-0261)

• vim: Heap-based buffer overflow in utf_head_off() in mbyte.c (CVE-2022-0318)

• vim: Heap-based buffer overflow in init_ccline() in ex_getln.c (CVE-2022-0359)

• vim: Illegal memory access when copying lines in visual mode leads to heap buffer overflow (CVE-2022-0361)

• vim: Heap-based buffer overflow in getexmodeline() in ex_getln.c (CVE-2022-0392)

• vim: Use after free in src/ex_cmds.c (CVE-2022-0413)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• SECURITY UPDATE: Stack corruption when looking for spell suggestions
  • debian/patches/CVE-2022-0408.patch: Prevent the depth increased too much, add a five second time limit to finding suggestions
  • CVE-2022-0408
• SECURITY UPDATE: Using freed memory when substitute with function call
  • debian/patches/CVE-2022-0413.patch: Make a copy of the substituted text
  • CVE-2022-0413
• SECURITY UPDATE: ':retab 0' may cause illegal memory access
  • debian/patches/CVE-2022-0417.patch: Limit the value of 'tabstop' to 10000
  • CVE-2022-0417
• SECURITY UPDATE: Using freed memory with ':lopen' and ':bwipe'
  • debian/patches/CVE-2022-0443.patch: Do not use a wiped out buffer
  • CVE-2022-0443

• CVE-2022-0408: fix stack corruption when looking for spell suggestions
• CVE-2022-0413: fix using freed memory when substitute with function call
• CVE-2022-0417: fix illegal memory access caused by ':retab 0'
• CVE-2022-0443: fix using freed memory with ':lopen' and ':bwipe'

• CVE-2022-0408: fix stack corruption when looking for spell suggestions
• CVE-2022-0413: fix using freed memory when substitute with function call
• CVE-2022-0417: fix illegal memory access caused by ':retab 0'
• CVE-2022-0443: fix using freed memory with ':lopen' and ':bwipe'

• CVE-2021-3796: fix use-after-free in nv_replace by getting the line pointer again after ins_copychar may have released it
• CVE-2021-3973: fix heap buffer overflow in find_file_in_path_option by rejecting len == 0 inputs
• CVE-2022-0413: fix use-after-free in do_sub when the substitute string is a "=" expression by copying the string before eval
• CVE-2022-0943: fix heap overflow in spell_suggest when "z=" in Visual mode by clamping badlen to the remaining line length
• CVE-2022-1620: fix NULL pointer access by guarding both vim_regexec calls in fname_match and the second fname_match call in buflist_match against rmp->regprog becoming NULL after the AUTOMATIC_ENGINE fallback fails to recompile the pattern
• CVE-2022-1796: fix use-after-free in find_pattern_in_path by making a copy of the identifier pointer before the call
• CVE-2022-2207: fix read-before-start-of-line in ins_bs by requiring w_cursor.col > 0 in the whitespace back-step loop
• CVE-2022-3235: fix use-after-free in cmdline input-method handling by tracking the owning buffer and checking buf_valid
• CVE-2022-3296: fix buffer underflow in ex_finally by searching for a valid CSF_TRY frame before accessing cs_flags
• CVE-2023-46246: fix integer overflow in :history by clamping long values to INT_MAX before casting to int
• CVE-2023-48231: fix use-after-free in win_close by returning early when the window is no longer valid after BufLeave
• CVE-2023-48706: fix use-after-free in ex_substitute by always allocating sub and freeing it on every exit path
• CVE-2026-33412: fix command injection via newline in glob() by adding '\n' to the SHELL_SPECIAL escape set

vim is vulnerable to out of bounds read (CVE-2022-0213) Heap-based Buffer Overflow in block_insert() in src/ops.c (CVE-2022-0261) a heap-based OOB read of size 1 (CVE-2022-0128) heap-based buffer overflow in utf_head_off() in mbyte.c (CVE-2022-0318) access of memory location before start of buffer (CVE-2022-0351) heap-based buffer overflow in init_ccline() in ex_getln.c (CVE-2022-0359) Stack-based Buffer Overflow in spellsuggest.c (CVE-2022-0408) use after free in src/ex_cmds.c (CVE-2022-0413) out-of-bounds read in delete_buff_tail() in getchar.c (CVE-2022-0393) heap-based-buffer-overflow in ex_retab() of src/indent.c (CVE-2022-0417) heap-use-after-free in enter_buffer() of src/buffer.c (CVE-2022-0443) heap overflow in ex_retab() may lead to crash (CVE-2022-0572) Stack-based Buffer Overflow in vim prior to 8.2. (CVE-2022-0629) NULL Pointer Dereference in vim prior to 8.2 (CVE-2022-0696) buffer overflow (CVE-2022-0714) Use of Out-of-range Pointer Offset (CVE-2022-0729) Use of Out-of-range Pointer Offset in vim (CVE-2022-0685) Use of Out-of-range Pointer Offset in vim (CVE-2022-0554) Heap-based Buffer Overflow occurs in vim (CVE-2022-0943) heap buffer overflow in get_one_sourceline (CVE-2022-1160) use after free in utf_ptr2char (CVE-2022-1154) global heap buffer overflow in skip_range (CVE-2022-1381) Out-of-range Pointer Offset (CVE-2022-1420) heap-buffer-overflow in append_command of src/ex_docmd.c (CVE-2022-1616) heap-buffer-overflow in cmdline_erase_chars of ex_getln.c (CVE-2022-1619) NULL Pointer Dereference in vim_regexec_string() of regexp.c (CVE-2022-1620) heap buffer overflow (CVE-2022-1621) buffer over-read (CVE-2022-1629) NULL pointer dereference in vim_regexec_string() of regexp.c (CVE-2022-1674) a buffer over-read found in scriptfile.c (CVE-2022-1769) Heap-based Buffer Overflow in cindent.c (CVE-2022-1733)

This update for vim fixes the following issues:

• CVE-2022-0318: Fixed heap-based buffer overflow (bsc#1195004).
• CVE-2021-3796: Fixed use-after-free in nv_replace() in normal.c (bsc#1190570).
• CVE-2021-3872: Fixed heap-based buffer overflow in win_redr_status() drawscreen.c (bsc#1191893).
• CVE-2021-3927: Fixed heap-based buffer overflow (bsc#1192481).
• CVE-2021-3928: Fixed stack-based buffer overflow (bsc#1192478).
• CVE-2021-4019: Fixed heap-based buffer overflow (bsc#1193294).
• CVE-2021-3984: Fixed illegal memory access when C-indenting could have led to heap buffer overflow (bsc#1193298).
• CVE-2021-3778: Fixed heap-based buffer overflow in regexp_nfa.c (bsc#1190533).
• CVE-2021-4193: Fixed out-of-bounds read (bsc#1194216).
• CVE-2021-46059: Fixed pointer dereference vulnerability via the vim_regexec_multi function at regexp.c (bsc#1194556).
• CVE-2022-0319: Fixded out-of-bounds read (bsc#1195066).
• CVE-2022-0351: Fixed uncontrolled recursion in eval7() (bsc#1195126).
• CVE-2022-0361: Fixed buffer overflow (bsc#1195126).
• CVE-2022-0413: Fixed use-after-free in src/ex_cmds.c (bsc#1195356).

These are all security issues fixed in the gvim-9.0.0453-2.1 package on the GA media of openSUSE Tumbleweed.

This update for vim fixes the following issues:

• CVE-2022-0318: Fixed heap-based buffer overflow (bsc#1195004).
• CVE-2021-3796: Fixed use-after-free in nv_replace() in normal.c (bsc#1190570).
• CVE-2021-3872: Fixed heap-based buffer overflow in win_redr_status() drawscreen.c (bsc#1191893).
• CVE-2021-3927: Fixed heap-based buffer overflow (bsc#1192481).
• CVE-2021-3928: Fixed stack-based buffer overflow (bsc#1192478).
• CVE-2021-4019: Fixed heap-based buffer overflow (bsc#1193294).
• CVE-2021-3984: Fixed illegal memory access when C-indenting could have led to heap buffer overflow (bsc#1193298).
• CVE-2021-3778: Fixed heap-based buffer overflow in regexp_nfa.c (bsc#1190533).
• CVE-2021-4193: Fixed out-of-bounds read (bsc#1194216).
• CVE-2021-46059: Fixed pointer dereference vulnerability via the vim_regexec_multi function at regexp.c (bsc#1194556).
• CVE-2022-0319: Fixded out-of-bounds read (bsc#1195066).
• CVE-2022-0351: Fixed uncontrolled recursion in eval7() (bsc#1195126).
• CVE-2022-0361: Fixed buffer overflow (bsc#1195126).
• CVE-2022-0413: Fixed use-after-free in src/ex_cmds.c (bsc#1195356).

This update for vim fixes the following issues:

• CVE-2022-0318: Fixed heap-based buffer overflow (bsc#1195004).
• CVE-2021-3796: Fixed use-after-free in nv_replace() in normal.c (bsc#1190570).
• CVE-2021-3872: Fixed heap-based buffer overflow in win_redr_status() drawscreen.c (bsc#1191893).
• CVE-2021-3927: Fixed heap-based buffer overflow (bsc#1192481).
• CVE-2021-3928: Fixed stack-based buffer overflow (bsc#1192478).
• CVE-2021-4019: Fixed heap-based buffer overflow (bsc#1193294).
• CVE-2021-3984: Fixed illegal memory access when C-indenting could have led to heap buffer overflow (bsc#1193298).
• CVE-2021-3778: Fixed heap-based buffer overflow in regexp_nfa.c (bsc#1190533).
• CVE-2021-4193: Fixed out-of-bounds read (bsc#1194216).
• CVE-2021-46059: Fixed pointer dereference vulnerability via the vim_regexec_multi function at regexp.c (bsc#1194556).
• CVE-2022-0319: Fixded out-of-bounds read (bsc#1195066).
• CVE-2022-0351: Fixed uncontrolled recursion in eval7() (bsc#1195126).
• CVE-2022-0361: Fixed buffer overflow (bsc#1195126).
• CVE-2022-0413: Fixed use-after-free in src/ex_cmds.c (bsc#1195356).

This update for vim fixes the following issues:

• CVE-2017-17087: Fixed information leak via .swp files (bsc#1070955).
• CVE-2021-3875: Fixed heap-based buffer overflow (bsc#1191770).
• CVE-2021-3903: Fixed heap-based buffer overflow (bsc#1192167).
• CVE-2021-3968: Fixed heap-based buffer overflow (bsc#1192902).
• CVE-2021-3973: Fixed heap-based buffer overflow (bsc#1192903).
• CVE-2021-3974: Fixed use-after-free (bsc#1192904).
• CVE-2021-4069: Fixed use-after-free in ex_open()in src/ex_docmd.c (bsc#1193466).
• CVE-2021-4136: Fixed heap-based buffer overflow (bsc#1193905).
• CVE-2021-4166: Fixed out-of-bounds read (bsc#1194093).
• CVE-2021-4192: Fixed use-after-free (bsc#1194217).
• CVE-2021-4193: Fixed out-of-bounds read (bsc#1194216).
• CVE-2022-0128: Fixed out-of-bounds read (bsc#1194388).
• CVE-2022-0213: Fixed heap-based buffer overflow (bsc#1194885).
• CVE-2022-0261: Fixed heap-based buffer overflow (bsc#1194872).
• CVE-2022-0318: Fixed heap-based buffer overflow (bsc#1195004).
• CVE-2022-0359: Fixed heap-based buffer overflow in init_ccline() in ex_getln.c (bsc#1195203).
• CVE-2022-0392: Fixed heap-based buffer overflow (bsc#1195332).
• CVE-2022-0407: Fixed heap-based buffer overflow (bsc#1195354).
• CVE-2022-0696: Fixed NULL pointer dereference (bsc#1196361).
• CVE-2022-1381: Fixed global heap buffer overflow in skip_range (bsc#1198596).
• CVE-2022-1420: Fixed out-of-range pointer offset (bsc#1198748).
• CVE-2022-1616: Fixed use-after-free in append_command (bsc#1199331).
• CVE-2022-1619: Fixed heap-based Buffer Overflow in function cmdline_erase_chars (bsc#1199333).
• CVE-2022-1620: Fixed NULL pointer dereference in function vim_regexec_string (bsc#1199334).
• CVE-2022-1733: Fixed heap-based buffer overflow in cindent.c (bsc#1199655).
• CVE-2022-1735: Fixed heap-based buffer overflow (bsc#1199651).
• CVE-2022-1771: Fixed stack exhaustion (bsc#1199693).
• CVE-2022-1785: Fixed out-of-bounds write (bsc#1199745).
• CVE-2022-1796: Fixed use-after-free in find_pattern_in_path (bsc#1199747).
• CVE-2022-1851: Fixed out-of-bounds read (bsc#1199936).
• CVE-2022-1897: Fixed out-of-bounds write (bsc#1200010).
• CVE-2022-1898: Fixed use-after-free (bsc#1200011).
• CVE-2022-1927: Fixed buffer over-read (bsc#1200012).

This update for vim fixes the following issues:

Updated to version 9.0.0814:

• Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
• Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
• Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
• Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
• Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
• Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
• Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
• Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
• Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
• Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
• Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
• Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
• Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
• Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
• Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
• Fixing bsc#1200884 Vim: Error on startup
• Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
• Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
• Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
• Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
• Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
• Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
• Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
• Fixing bsc#1201620 vim: SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
• Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
• Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
• Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
• Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
• Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
• Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
• Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
• Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
• Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
• Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
• Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
• Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
• Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
• Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
• Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
• Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
• Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
• Fixing bsc#1201154 VUL-1:…

It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possible execute arbitrary code.

It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possible execute arbitrary code. This issue only affected Ubuntu 14.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-0413, CVE-2022-1629, CVE-2022-1674, CVE-2022-1733, CVE-2022-1735, CVE-2022-1785, CVE-2022-1796, CVE-2022-1851, CVE-2022-1898, CVE-2022-1942, CVE-2022-1968, CVE-2022-2124, CVE-2022-2125, CVE-2022-2126, CVE-2022-2129, CVE-2022-2175, CVE-2022-2183, CVE-2022-2206, CVE-2022-2304, CVE-2022-2345, CVE-2022-2581)

It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possible execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1720, CVE-2022-2571, CVE-2022-2845, CVE-2022-2849, CVE-2022-2923)

It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possible execute arbitrary code. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-1927, CVE-2022-2344)

It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possible execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-2946)

It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possible execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-2980)