CVE-2022-2343

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.(CVE-2022-2210)

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.(CVE-2022-2257)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.(CVE-2022-2264)

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.(CVE-2022-2286)

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.(CVE-2022-2287)

Use After Free in GitHub repository vim/vim prior to 9.0.(CVE-2022-2289)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044.(CVE-2022-2343)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044.

• SECURITY UPDATE: Using freed memory with recursive substitute
  • debian/patches/CVE-2022-2345.patch: Always make a copy for reg_prev_sub
  • CVE-2022-2345
• SECURITY UPDATE: Reading past end of completion with duplicate match
  • debian/patches/CVE-2022-2344.patch: Check string length
  • CVE-2022-2344
• SECURITY UPDATE: Reading past end of completion with a long line and 'infercase' set
  • debian/patches/CVE-2022-2343.patch: Allocate the string if needed
  • CVE-2022-2343
• SECURITY UPDATE: Accessing uninitialized memory when completing long line
  • debian/patches/CVE-2022-2522.patch: Terminate string with NUL.
  • CVE-2022-2522

• CVE-2022-2345: fix using freed memory with recursive substitute
• CVE-2022-2344: fix reading past end of completion with duplicate match
• CVE-2022-2343: fix reading past end of completion with a long line and 'infercase' set
• CVE-2022-2522: fix accessing uninitialized memory when completing long line

• CVE-2022-2345: fix using freed memory with recursive substitute
• CVE-2022-2344: fix reading past end of completion with duplicate match
• CVE-2022-2343: fix reading past end of completion with a long line and 'infercase' set
• CVE-2022-2522: fix accessing uninitialized memory when completing long line

• SECURITY UPDATE: Reading past end of completion with a long line and 'infercase' set
  • debian/patches/CVE-2022-2343.patch: Allocate the string if needed
  • CVE-2022-2343
• SECURITY UPDATE: Accessing uninitialized memory when completing long line
  • debian/patches/CVE-2022-2522.patch: Terminate string with NUL.
  • CVE-2022-2522

• CVE-2021-4173: fix double free in Vim9 nested :def function definition
• CVE-2022-3352: fix use-after-free when SpellFileMissing autocmd deletes the current buffer during spell file loading
• CVE-2022-2343: fix heap buffer overflow in ins_compl_add_infercase() when completing a long line with 'infercase' set

• CVE-2021-4173: fix double free in Vim9 nested :def function definition
• CVE-2022-3352: fix use-after-free when SpellFileMissing autocmd deletes the current buffer during spell file loading
• CVE-2022-2343: fix heap buffer overflow in ins_compl_add_infercase() when completing a long line with 'infercase' set

• CVE-2022-2343: heap-buffer-overflow in ins_compl_add_infercase() on long line with 'infercase' (upstream vim 9.0.0045)
• CVE-2022-3296: stack underflow in ex_finally / ex_endtry when :finally lacks an enclosing :try (upstream vim 9.0.0577)

• CVE-2022-2343: heap-buffer-overflow in ins_compl_add_infercase() on long line with 'infercase' (upstream vim 9.0.0045)
• CVE-2022-3296: stack underflow in ex_finally / ex_endtry when :finally lacks an enclosing :try (upstream vim 9.0.0577)

• CVE-2022-0572: heap overflow on vcol-overflow in :retab (upstream vim 8.2.4359)
• CVE-2022-0368: illegal memory access when undo makes Visual area invalid (upstream vim 8.2.4217)
• CVE-2022-0685: crash on multi-byte char in unix_expandpath() (upstream vim 8.2.4418)
• CVE-2022-2125: heap overflow in get_lisp_indent() (upstream vim 8.2.5122)
• CVE-2022-2183: reading past end-of-line in lisp indenting (upstream vim 8.2.5151)
• CVE-2022-2124: reading past end-of-line in current_quote() (upstream vim 8.2.5120)
• CVE-2022-2344: heap overflow in ins_compl_add() (upstream vim 9.0.0046)
• CVE-2022-3256: use-after-free in movemark() when autocmd changes mark (upstream vim 9.0.0530)
• CVE-2023-4752: heap use-after-free in ins_compl_get_exp() (upstream vim 9.0.1858)
• CVE-2022-2126: spell-suggest read past bad word (upstream vim 8.2.5123)
• CVE-2022-2946: use-after-free in do_tag() when tagfunc invalidates tagstack (upstream vim 9.0.0246)
• CVE-2022-1720: OOB read in get_visual_text() (upstream vim 8.2.4956)
• CVE-2022-3234: OOB write in op_replace() (upstream vim 9.0.0483)
• CVE-2023-0433: same_leader() read past end-of-line on short comment line (upstream vim 9.0.1225)
• CVE-2023-4781: heap-buffer-overflow in vim_regsub_both() via nmatch underflow in :substitute, plus textlock guard in win_exchange() (upstream vim 9.0.1873)
• CVE-2022-0351: crash on deeply nested expression (upstream vim 8.2.4206)
• CVE-2022-2175: new_cmdpos leak across register insertion in getcmdline() (upstream vim 8.2.5148)
• CVE-2026-39881: netbeans command injection via crafted sign/highlight identifier + special-keys (upstream vim 9.2.0316)
• CVE-2021-4166: heap-buffer-overflow when clearing the argument list while it is being used (upstream vim 8.2.3884, with 8.2.2421 + 8.2.2463 prereqs for arglist_locked plumbing)
• CVE-2022-2343: heap-buffer-overflow in ins_compl_add_infercase() on long line with 'infercase' (upstream vim 9.0.0045)
• CVE-2022-3296: stack underflow in ex_finally / ex_endtry when :finally lacks an enclosing :try (upstream vim 9.0.0577)

• SECURITY UPDATE: crash when clearing the argument list while using it
  • debian/patches/CVE-2021-4166.patch: lock the argument list for ":all"; matches upstream patch 8.2.3884.
  • CVE-2021-4166
• SECURITY UPDATE: reading past end of completion with a long line
  • debian/patches/CVE-2022-2343.patch: build the inferred-case text in a growarray when it outgrows IObuff; matches upstream patch 9.0.0045.
  • CVE-2022-2343
• SECURITY UPDATE: memory access errors when calling setloclist() in an autocommand
  • debian/patches/CVE-2022-3016.patch: give an error if the list was changed unexpectedly and drop the stale pointer instead of storing it back; matches upstream patches 8.2.1677 and 9.0.0286.
  • CVE-2022-3016
• SECURITY UPDATE: SpellFileMissing autocmd may delete buffer
  • debian/patches/CVE-2022-3352.patch: disallow deleting the current buffer while loading a spell file; matches upstream patch 9.0.0614.
  • CVE-2022-3352
• SECURITY UPDATE: filetype autocmd may cause freed memory access
  • debian/patches/CVE-2022-3705.patch: set the quickfix-busy flag while filling the buffer; matches upstream patch 9.0.0805.
  • CVE-2022-3705
• SECURITY UPDATE: invalid memory access in substitute with function
  • debian/patches/CVE-2022-4141.patch: check for text or buffer being locked before jumping to a file; matches upstream patch 9.0.0947.
  • CVE-2022-4141

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. (CVE-2022-2000, CVE-2022-2129, CVE-2022-2210)

Use After Free in GitHub repository vim/vim prior to 8.2. (CVE-2022-2042)

Buffer Over-read in GitHub repository vim/vim prior to 8.2. (CVE-2022-2124, CVE-2022-2175)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. (CVE-2022-2125, CVE-2022-2182, CVE-2022-2207)

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. (CVE-2022-2126, CVE-2022-2183, CVE-2022-2206)

NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163. (CVE-2022-2208)

NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2. (CVE-2022-2231)

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. (CVE-2022-2257, CVE-2022-2286, CVE-2022-2287, CVE-2022-2288)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. (CVE-2022-2264, CVE-2022-2284)

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0. (CVE-2022-2285)

Use After Free in GitHub repository vim/vim prior to 9.0. (CVE-2022-2289)

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. (CVE-2022-2304)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044. (CVE-2022-2343)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045. (CVE-2022-2344)

Use After Free in GitHub repository vim/vim prior to 9.0.0046. (CVE-2022-2345)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061. (CVE-2022-2522)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0101. (CVE-2022-2571)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0102. (CVE-2022-2580)

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0104. (CVE-2022-2581)

Undefined Behavior for Input to API in GitHub repository vim/vim prior to 9.0.0100. (CVE-2022-2598)

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212. (CVE-2022-2816)

Use After Free in GitHub repository vim/vim prior to 9.0.0213. (CVE-2022-2817)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211. (CVE-2022-2819)

Buffer Over-read in GitHub repository vim/vim prior to 9.0.0218. (CVE-2022-2845)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220. (CVE-2022-2849)

Use After Free in GitHub repository vim/vim prior to 9.0.0221. (CVE-2022-2862)

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224. (CVE-2022-2874)

Use After Free in GitHub repository vim/vim prior to 9.0.0225. (CVE-2022-2889)

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240. (CVE-2022-2923)

Use After Free in GitHub repository vim/vim prior to 9.0.0246. (CVE-2022-2946)

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0259. (CVE-2022-2980)

Use After Free in GitHub repository vim/vim prior to 9.0.0260. (CVE-2022-2982)

Use After Free in GitHub repository vim/vim prior to 9.0.0286. (CVE-2022-3016)

Use After Free in GitHub repository vim/vim prior to 9.0.0322. (CVE-2022-3037)

Use After Free in GitHub repository vim/vim prior to 9.0.0360. (CVE-2022-3099)

Use After Free in GitHub repository vim/vim prior to 9.0.0389. (CVE-2022-3134)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483. (CVE-2022-3234)

Use After Free in GitHub repository vim/vim prior to 9.0.0490. (CVE-2022-3235)

Use After Free in GitHub repository vim/vim prior to 9.0.0530. (CVE-2022-3256)

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552. (CVE-2022-3278)

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577. (CVE-2022-3296)

Use After Free in GitHub repository vim/vim prior to 9.0.0579. (CVE-2022-3297)

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598. (CVE-2022-3324)

Use After Free in GitHub repository vim/vim prior to 9.0.0614. (CVE-2022-3352)

Affected by this issue is the function qf_update_buffer of the file quickfix.c of the…

These are all security issues fixed in the gvim-9.0.0453-2.1 package on the GA media of openSUSE Tumbleweed.

This update for vim fixes the following issues:

Updated to version 9.0 with patch level 0313:

• CVE-2022-2183: Fixed out-of-bounds read through get_lisp_indent() (bsc#1200902).
• CVE-2022-2182: Fixed heap-based buffer overflow through parse_cmd_address() (bsc#1200903).
• CVE-2022-2175: Fixed buffer over-read through cmdline_insert_reg() (bsc#1200904).
• CVE-2022-2304: Fixed stack buffer overflow in spell_dump_compl() (bsc#1201249).
• CVE-2022-2343: Fixed heap-based buffer overflow in GitHub repository vim prior to 9.0.0044 (bsc#1201356).
• CVE-2022-2344: Fixed another heap-based buffer overflow vim prior to 9.0.0045 (bsc#1201359).
• CVE-2022-2345: Fixed use after free in GitHub repository vim prior to 9.0.0046. (bsc#1201363).
• CVE-2022-2819: Fixed heap-based Buffer Overflow in compile_lock_unlock() (bsc#1202414).
• CVE-2022-2874: Fixed NULL Pointer Dereference in generate_loadvar() (bsc#1202552).
• CVE-2022-1968: Fixed use after free in utf_ptr2char (bsc#1200270).
• CVE-2022-2124: Fixed out of bounds read in current_quote() (bsc#1200697).
• CVE-2022-2125: Fixed out of bounds read in get_lisp_indent() (bsc#1200698).
• CVE-2022-2126: Fixed out of bounds read in suggest_trie_walk() (bsc#1200700).
• CVE-2022-2129: Fixed out of bounds write in vim_regsub_both() (bsc#1200701).
• CVE-2022-1720: Fixed out of bounds read in grab_file_name() (bsc#1200732).
• CVE-2022-2264: Fixed out of bounds read in inc() (bsc#1201132).
• CVE-2022-2284: Fixed out of bounds read in utfc_ptr2len() (bsc#1201133).
• CVE-2022-2285: Fixed negative size passed to memmove() due to integer overflow (bsc#1201134).
• CVE-2022-2286: Fixed out of bounds read in ins_bytes() (bsc#1201135).
• CVE-2022-2287: Fixed out of bounds read in suggest_trie_walk() (bsc#1201136).
• CVE-2022-2231: Fixed null pointer dereference skipwhite() (bsc#1201150).
• CVE-2022-2210: Fixed out of bounds read in ml_append_int() (bsc#1201151).
• CVE-2022-2208: Fixed null pointer dereference in diff_check() (bsc#1201152).
• CVE-2022-2207: Fixed out of bounds read in ins_bs() (bsc#1201153).
• CVE-2022-2257: Fixed out of bounds read in msg_outtrans_special() (bsc#1201154).
• CVE-2022-2206: Fixed out of bounds read in msg_outtrans_attr() (bsc#1201155).
• CVE-2022-2522: Fixed out of bounds read via nested autocommand (bsc#1201863).
• CVE-2022-2571: Fixed heap-based buffer overflow related to ins_comp_get_next_word_or_line() (bsc#1202046).
• CVE-2022-2580: Fixed heap-based buffer overflow related to eval_string() (bsc#1202049).
• CVE-2022-2581: Fixed out-of-bounds read related to cstrchr() (bsc#1202050).
• CVE-2022-2598: Fixed undefined behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() (bsc#1202051).
• CVE-2022-2817: Fixed use after gree in f_assert_fails() (bsc#1202420).
• CVE-2022-2816: Fixed out-of-bounds Read in check_vim9_unlet() (bsc#1202421).
• CVE-2022-2862: Fixed use-after-free in compile_nested_function() (bsc#1202511).
• CVE-2022-2849: Fixed invalid memory access related to mb_ptr2len() (bsc#1202512).
• CVE-2022-2845: Fixed buffer Over-read related to display_dollar() (bsc#1202515).
• CVE-2022-2889: Fixed use-after-free in find_var_also_in_script() in evalvars.c (bsc#1202599).
• CVE-2022-2923: Fixed NULL pointer dereference in GitHub repository vim/vim prior to 9.0.0240 (bsc#1202687).
• CVE-2022-2946: Fixed use after free in function vim_vsnprintf_typval (bsc#1202689).
• CVE-2022-3016: Fixed use after free in vim prior to 9.0.0285 (bsc#1202862).

Bugfixes:

• Fixing vim error on startup (bsc#1200884).
• Fixing vim SUSE Linux Enterprise Server 15 SP4 Basesystem plugin-tlib issue (bsc#1201620).

This update for vim fixes the following issues:

Updated to version 9.0.0814:

• Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
• Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
• Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
• Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
• Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
• Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
• Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
• Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
• Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
• Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
• Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
• Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
• Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
• Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
• Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
• Fixing bsc#1200884 Vim: Error on startup
• Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
• Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
• Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
• Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
• Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
• Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
• Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
• Fixing bsc#1201620 vim: SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
• Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
• Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
• Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
• Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
• Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
• Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
• Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
• Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
• Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
• Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
• Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
• Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
• Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
• Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
• Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
• Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
• Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
• Fixing bsc#1201154 VUL-1:…