CVE-2022-0417

Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.

Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.(CVE-2022-0261)

Heap-based Buffer Overflow in vim/vim prior to 8.2.(CVE-2022-0318)

Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.(CVE-2022-0351)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.(CVE-2022-0359)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.(CVE-2022-0361)

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.(CVE-2022-0368)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.(CVE-2022-0392)

Use After Free in GitHub repository vim/vim prior to 8.2.(CVE-2022-0413)

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.(CVE-2022-0408)

Use After Free in Conda vim prior to 8.2.(CVE-2022-0443)

Heap-based Buffer Overflow in Conda vim prior to 8.2.(CVE-2022-0417)

vim is vulnerable to Heap-based Buffer Overflow(CVE-2022-0213)

Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.

• SECURITY UPDATE: Stack corruption when looking for spell suggestions
  • debian/patches/CVE-2022-0408.patch: Prevent the depth increased too much, add a five second time limit to finding suggestions
  • CVE-2022-0408
• SECURITY UPDATE: Using freed memory when substitute with function call
  • debian/patches/CVE-2022-0413.patch: Make a copy of the substituted text
  • CVE-2022-0413
• SECURITY UPDATE: ':retab 0' may cause illegal memory access
  • debian/patches/CVE-2022-0417.patch: Limit the value of 'tabstop' to 10000
  • CVE-2022-0417
• SECURITY UPDATE: Using freed memory with ':lopen' and ':bwipe'
  • debian/patches/CVE-2022-0443.patch: Do not use a wiped out buffer
  • CVE-2022-0443

• CVE-2022-0408: fix stack corruption when looking for spell suggestions
• CVE-2022-0413: fix using freed memory when substitute with function call
• CVE-2022-0417: fix illegal memory access caused by ':retab 0'
• CVE-2022-0443: fix using freed memory with ':lopen' and ':bwipe'

• CVE-2022-0408: fix stack corruption when looking for spell suggestions
• CVE-2022-0413: fix using freed memory when substitute with function call
• CVE-2022-0417: fix illegal memory access caused by ':retab 0'
• CVE-2022-0443: fix using freed memory with ':lopen' and ':bwipe'

vim is vulnerable to out of bounds read (CVE-2022-0213) Heap-based Buffer Overflow in block_insert() in src/ops.c (CVE-2022-0261) a heap-based OOB read of size 1 (CVE-2022-0128) heap-based buffer overflow in utf_head_off() in mbyte.c (CVE-2022-0318) access of memory location before start of buffer (CVE-2022-0351) heap-based buffer overflow in init_ccline() in ex_getln.c (CVE-2022-0359) Stack-based Buffer Overflow in spellsuggest.c (CVE-2022-0408) use after free in src/ex_cmds.c (CVE-2022-0413) out-of-bounds read in delete_buff_tail() in getchar.c (CVE-2022-0393) heap-based-buffer-overflow in ex_retab() of src/indent.c (CVE-2022-0417) heap-use-after-free in enter_buffer() of src/buffer.c (CVE-2022-0443) heap overflow in ex_retab() may lead to crash (CVE-2022-0572) Stack-based Buffer Overflow in vim prior to 8.2. (CVE-2022-0629) NULL Pointer Dereference in vim prior to 8.2 (CVE-2022-0696) buffer overflow (CVE-2022-0714) Use of Out-of-range Pointer Offset (CVE-2022-0729) Use of Out-of-range Pointer Offset in vim (CVE-2022-0685) Use of Out-of-range Pointer Offset in vim (CVE-2022-0554) Heap-based Buffer Overflow occurs in vim (CVE-2022-0943) heap buffer overflow in get_one_sourceline (CVE-2022-1160) use after free in utf_ptr2char (CVE-2022-1154) global heap buffer overflow in skip_range (CVE-2022-1381) Out-of-range Pointer Offset (CVE-2022-1420) heap-buffer-overflow in append_command of src/ex_docmd.c (CVE-2022-1616) heap-buffer-overflow in cmdline_erase_chars of ex_getln.c (CVE-2022-1619) NULL Pointer Dereference in vim_regexec_string() of regexp.c (CVE-2022-1620) heap buffer overflow (CVE-2022-1621) buffer over-read (CVE-2022-1629) NULL pointer dereference in vim_regexec_string() of regexp.c (CVE-2022-1674) a buffer over-read found in scriptfile.c (CVE-2022-1769) Heap-based Buffer Overflow in cindent.c (CVE-2022-1733)

These are all security issues fixed in the gvim-8.2.4286-1.1 package on the GA media of openSUSE Tumbleweed.

It was discovered that Vim makes illegal memory calls when pasting brackets in Ex mode. An attacker could possibly use this to crash Vim, access or modify memory, or execute arbitrary commands. This issue affected only Ubuntu 20.04 and 22.04 (CVE-2022-0392)

It was discovered that Vim makes illegal memory calls when making certain retab calls. An attacker could possibly use this to crash Vim, access or modify memory, or execute arbitrary commands. (CVE-2022-0417)