CVE-2022-4293

Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing.It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.(CVE-2022-4293)

Use After Free in GitHub repository vim/vim prior to 9.0.0882.(CVE-2022-4292)

Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.

• CVE-2021-3875: fix ml_get error after search with range; clamp ea->line2 to the buffer length in get_address() so out-of-range addresses do not produce an out-of-bounds read (ex_docmd.c, upstream patch 8.2.3489)
• CVE-2022-4293: fix crash when dividing the largest negative integer by -1 in num_divide(); detect the LONG_MIN / -1 case and clamp the result (typval.c, upstream patch 9.0.0913)
• CVE-2023-48231: fix use-after-free in win_close() when an autocmd closes a previously-validated window; re-check window validity before setting w_closing (window.c, upstream patch 9.0.2106)
• CVE-2023-48235: fix integer overflow in ex address parsing; verify lnum is positive before subtracting from LONG_MAX in get_address() and add e_line_number_out_of_range[] in src/errors.h (ex_docmd.c + errors.h, upstream patches 8.2.3659 + 9.0.2110)
• CVE-2024-41957: fix use-after-free in tagstack_clear_entry(); use VIM_CLEAR to NULL pointers when freeing the tagstack on win_free (window.c, upstream patch 9.1.0647)
• CVE-2024-43374: fix use-after-free in alist_add(); lock the current window across the buflist_add() autocmd window so its tagstack reference cannot be freed underneath us (arglist.c, upstream patch 9.1.0678)
• CVE-2024-47814: fix use-after-free when closing a buffer; abort do_ecmd() if the new buffer is marked for deletion via b_locked or b_locked_split (ex_cmds.c, upstream patch 9.1.0764)

Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.

This update for vim fixes the following issues:

Updated to version 9.0.1040:

• CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 (bsc#1206028).
• CVE-2022-3520: vim: Heap-based Buffer Overflow (bsc#1206071).
• CVE-2022-3591: vim: Use After Free (bsc#1206072).
• CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882 (bsc#1206075).
• CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804 (bsc#1206077).
• CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 (bsc#1205797).
• CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c (bsc#1204779).

This update for vim fixes the following issues:

• Updated to version 9.0.1234:
  • CVE-2023-0433: Fixed an out of bounds memory access that could cause a crash (bsc#1207396).
  • CVE-2023-0288: Fixed an out of bounds memory access that could cause a crash (bsc#1207162).
  • CVE-2023-0054: Fixed an out of bounds memory write that could cause a crash or memory corruption (bsc#1206868).
  • CVE-2023-0051: Fixed an out of bounds memory access that could cause a crash (bsc#1206867).
  • CVE-2023-0049: Fixed an out of bounds memory access that could cause a crash (bsc#1206866).
  • CVE-2022-3491: Fixed an out of bounds memory access that could cause a crash (bsc#1206028).
  • CVE-2022-3520: Fixed an out of bounds memory access that could cause a crash (bsc#1206071).
  • CVE-2022-3591: Fixed a use-after-free issue that could cause memory corruption or undefined behavior (bsc#1206072).
  • CVE-2022-4292: Fixed a use-after-free issue that could cause memory corruption or undefined behavior (bsc#1206075).
  • CVE-2022-4293: Fixed a floating point exception that could cause a crash (bsc#1206077).
  • CVE-2022-4141: Fixed an out of bounds memory write that could cause a crash or memory corruption (bsc#1205797).
  • CVE-2022-3705: Fixed an use-after-free issue that could cause a crash or memory corruption (bsc#1204779).

It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-3235, CVE-2022-3278, CVE-2022-3297, CVE-2022-3491)

It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-3352, CVE-2022-4292)

It was discovered that Vim incorrectly handled memory when replacing in virtualedit mode. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-3234)

It was discovered that Vim incorrectly handled memory when autocmd changes mark. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-3256)

It was discovered that Vim did not properly perform checks on array index with negative width window. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. (CVE-2022-3324)

It was discovered that Vim did not properly perform checks on a put command column with a visual block. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-3520)

It was discovered that Vim incorrectly handled memory when using autocommand to open a window. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-3591)

It was discovered that Vim incorrectly handled memory when updating buffer of the component autocmd handler. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-3705)

It was discovered that Vim incorrectly handled floating point comparison with incorrect operator. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. and Ubuntu 22.04 LTS. (CVE-2022-4293)