CVE-2022-1886

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.(CVE-2022-1886)

Buffer Over-read in GitHub repository vim/vim prior to 8.2.(CVE-2022-1927)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

• SECURITY UPDATE: ml_get() error when exchanging windows in Visual mode
  • debian/patches/CVE-2022-0319.patch: Correct end of Visual area when entering another buffer
  • CVE-2022-0319
• SECURITY UPDATE: Cursor may be in an invalid position after text formatting
  • debian/patches/CVE-2022-1851.patch: Correct the cursor position after formatting
  • CVE-2022-1851
• SECURITY UPDATE: Access before start of text with a put command
  • debian/patches/CVE-2022-1886.patch: Check the length is more than zero
  • CVE-2022-1886
• SECURITY UPDATE: Using freed memory with "]d".
  • debian/patches/CVE-2022-1898: Copy the pattern before searching
  • CVE-2022-1898

• CVE-2022-0319: correct end of Visual area when entering another buffer
• CVE-2022-1851: fix invalid cursor position after text formatting
• CVE-2022-1886: fix access before start of text with a put command
• CVE-2022-1898: fix using freed memory with ']d'

• CVE-2022-0319: correct end of Visual area when entering another buffer
• CVE-2022-1851: fix invalid cursor position after text formatting
• CVE-2022-1886: fix access before start of text with a put command
• CVE-2022-1898: fix using freed memory with ']d'

• SECURITY UPDATE: Crash with weird 'vartabstop' value
  • debian/patches/CVE-2022-0714.patch: Check for running into the end of the line
  • CVE-2022-0714
• SECURITY UPDATE: Substitute overwrites allocated buffer
  • debian/patches/CVE-2022-1897.patch: Disallow undo when in a substitute command
  • CVE-2022-1897
• SECURITY UPDATE: Cursor position may be invalid after "0;" range
  • debian/patches/CVE-2022-1927.patch: Check the cursor position when it was set by ";" in the range
  • CVE-2022-1886

• SECURITY UPDATE: Heap-based Buffer Overflow

• debian/patches/CVE-2022-1733.patch: Check for NUL to prevent reading past end of the line when C-indenting
• CVE-2022-1733

• SECURITY UPDATE: Use After Free

• debian/patches/CVE-2022-1796.patch: Fix accessing freed memory when line is flushed by making a copy of the search pattern
• CVE-2022-1796

• SECURITY UPDATE: Heap-based Buffer Overflow

• debian/patches/CVE-2022-1886.patch: Check the length is more than zero to fix access before start of text with a put command
• CVE-2022-1886

• SECURITY UPDATE: Use After Free

• debian/patches/CVE-2022-3016.patch: Return QF_ABORT when location list changed in autocmd
• CVE-2022-3016

out-of-bounds read in gchar_cursor() in misc1.c (CVE-2022-1851) use-after-free in find_pattern_in_path() in search.c (CVE-2022-1898) out-of-bounds write in vim_regsub_both() in regexp.c (CVE-2022-1897) buffer over-read in utf_ptr2char() in mbyte.c (CVE-2022-1927 ) out of bounds write in vim_regsub_both() (CVE-2022-1942) heap-based buffer overflow in function utf_head_off (CVE-2022-1886)

These are all security issues fixed in the gvim-9.0.0453-2.1 package on the GA media of openSUSE Tumbleweed.

It was discovered that Vim could be made to dereference invalid memory. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1725)

It was discovered that Vim could be made to recurse infinitely. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1771)

It was discovered that Vim could be made to write out of bounds with a put command. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-1886)

It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1897, CVE-2022-2000)

It was discovered that Vim did not properly manage memory in the spell command. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-2042)

It was discovered that Vim did not properly manage memory. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2023-46246, CVE-2023-48231)

It was discovered that Vim could be made to divide by zero. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 23.04 and Ubuntu 23.10. (CVE-2023-48232)

It was discovered that Vim contained multiple arithmetic overflows. An attacker could possibly use these issues to cause a denial of service. (CVE-2023-48233, CVE-2023-48234, CVE-2023-48235, CVE-2023-48236, CVE-2023-48237)

It was discovered that Vim did not properly manage memory in the substitute command. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-48706)