CVE-2022-2946

Use After Free in GitHub repository vim/vim prior to 9.0.0246.

Use After Free in GitHub repository vim/vim prior to 9.0.0246.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240.(CVE-2022-2923)

Use After Free in GitHub repository vim/vim prior to 9.0.0246.(CVE-2022-2946)

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0259.(CVE-2022-2980)

Use After Free in GitHub repository vim/vim prior to 9.0.0286.(CVE-2022-3016)

Use After Free in GitHub repository vim/vim prior to 9.0.0246.

• CVE-2022-2125: fix out-of-bounds read in get_lisp_indent(); break out of the inner loop on NUL byte (indent.c, upstream patch 8.2.5122)
• CVE-2021-3974: fix use-after-free in nfa_regmatch() when a substitute callback frees the regline during a mark comparison; save col and re-fetch rex.line via reg_getline() after getmark_buf() (regexp.c + regexp_nfa.c, upstream patch 8.2.3612)
• CVE-2022-2206: fix OOB read after terminal resize lowers Rows below cmdline_row / msg_row; clamp both to Rows - 1 in check_shellsize() (term.c, upstream patch 8.2.5160)
• CVE-2022-2946: fix use-after-free in do_tag() when 'tagfunc' deletes the buffer; make a vim_strsave copy of the tagstack tagname before calling user code (tag.c, upstream patch 9.0.0246)
• CVE-2022-2286: fix heap-buffer-overflow in the Ctrl-E completion-stop path when the completion leader shrinks below the original text; bounds-check compl_len against replacement string length before ins_bytes_len() (insexpand.c, upstream patch 9.0.0020)

• CVE-2022-2125: fix out-of-bounds read in get_lisp_indent(); break out of the inner loop on NUL byte (indent.c, upstream patch 8.2.5122)
• CVE-2021-3974: fix use-after-free in nfa_regmatch() when a substitute callback frees the regline during a mark comparison; save col and re-fetch rex.line via reg_getline() after getmark_buf() (regexp.c + regexp_nfa.c, upstream patch 8.2.3612)
• CVE-2022-2206: fix OOB read after terminal resize lowers Rows below cmdline_row / msg_row; clamp both to Rows - 1 in check_shellsize() (term.c, upstream patch 8.2.5160)
• CVE-2022-2946: fix use-after-free in do_tag() when 'tagfunc' deletes the buffer; make a vim_strsave copy of the tagstack tagname before calling user code (tag.c, upstream patch 9.0.0246)
• CVE-2022-2286: fix heap-buffer-overflow in the Ctrl-E completion-stop path when the completion leader shrinks below the original text; bounds-check compl_len against replacement string length before ins_bytes_len() (insexpand.c, upstream patch 9.0.0020)

• CVE-2022-0572: heap overflow on vcol-overflow in :retab (upstream vim 8.2.4359)
• CVE-2022-0368: illegal memory access when undo makes Visual area invalid (upstream vim 8.2.4217)
• CVE-2022-0685: crash on multi-byte char in unix_expandpath() (upstream vim 8.2.4418)
• CVE-2022-2125: heap overflow in get_lisp_indent() (upstream vim 8.2.5122)
• CVE-2022-2183: reading past end-of-line in lisp indenting (upstream vim 8.2.5151)
• CVE-2022-2124: reading past end-of-line in current_quote() (upstream vim 8.2.5120)
• CVE-2022-2344: heap overflow in ins_compl_add() (upstream vim 9.0.0046)
• CVE-2022-3256: use-after-free in movemark() when autocmd changes mark (upstream vim 9.0.0530)
• CVE-2023-4752: heap use-after-free in ins_compl_get_exp() (upstream vim 9.0.1858)
• CVE-2022-2126: spell-suggest read past bad word (upstream vim 8.2.5123)
• CVE-2022-2946: use-after-free in do_tag() when tagfunc invalidates tagstack (upstream vim 9.0.0246)
• CVE-2022-1720: OOB read in get_visual_text() (upstream vim 8.2.4956)
• CVE-2022-3234: OOB write in op_replace() (upstream vim 9.0.0483)
• CVE-2023-0433: same_leader() read past end-of-line on short comment line (upstream vim 9.0.1225)
• CVE-2023-4781: heap-buffer-overflow in vim_regsub_both() via nmatch underflow in :substitute, plus textlock guard in win_exchange() (upstream vim 9.0.1873)
• CVE-2022-0351: crash on deeply nested expression (upstream vim 8.2.4206)
• CVE-2022-2175: new_cmdpos leak across register insertion in getcmdline() (upstream vim 8.2.5148)
• CVE-2026-39881: netbeans command injection via crafted sign/highlight identifier + special-keys (upstream vim 9.2.0316)
• CVE-2021-4166: heap-buffer-overflow when clearing the argument list while it is being used (upstream vim 8.2.3884, with 8.2.2421 + 8.2.2463 prereqs for arglist_locked plumbing)
• CVE-2022-2343: heap-buffer-overflow in ins_compl_add_infercase() on long line with 'infercase' (upstream vim 9.0.0045)
• CVE-2022-3296: stack underflow in ex_finally / ex_endtry when :finally lacks an enclosing :try (upstream vim 9.0.0577)

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. (CVE-2022-2000, CVE-2022-2129, CVE-2022-2210)

Use After Free in GitHub repository vim/vim prior to 8.2. (CVE-2022-2042)

Buffer Over-read in GitHub repository vim/vim prior to 8.2. (CVE-2022-2124, CVE-2022-2175)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. (CVE-2022-2125, CVE-2022-2182, CVE-2022-2207)

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. (CVE-2022-2126, CVE-2022-2183, CVE-2022-2206)

NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163. (CVE-2022-2208)

NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2. (CVE-2022-2231)

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. (CVE-2022-2257, CVE-2022-2286, CVE-2022-2287, CVE-2022-2288)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. (CVE-2022-2264, CVE-2022-2284)

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0. (CVE-2022-2285)

Use After Free in GitHub repository vim/vim prior to 9.0. (CVE-2022-2289)

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. (CVE-2022-2304)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044. (CVE-2022-2343)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045. (CVE-2022-2344)

Use After Free in GitHub repository vim/vim prior to 9.0.0046. (CVE-2022-2345)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061. (CVE-2022-2522)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0101. (CVE-2022-2571)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0102. (CVE-2022-2580)

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0104. (CVE-2022-2581)

Undefined Behavior for Input to API in GitHub repository vim/vim prior to 9.0.0100. (CVE-2022-2598)

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212. (CVE-2022-2816)

Use After Free in GitHub repository vim/vim prior to 9.0.0213. (CVE-2022-2817)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211. (CVE-2022-2819)

Buffer Over-read in GitHub repository vim/vim prior to 9.0.0218. (CVE-2022-2845)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220. (CVE-2022-2849)

Use After Free in GitHub repository vim/vim prior to 9.0.0221. (CVE-2022-2862)

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224. (CVE-2022-2874)

Use After Free in GitHub repository vim/vim prior to 9.0.0225. (CVE-2022-2889)

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240. (CVE-2022-2923)

Use After Free in GitHub repository vim/vim prior to 9.0.0246. (CVE-2022-2946)

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0259. (CVE-2022-2980)

Use After Free in GitHub repository vim/vim prior to 9.0.0260. (CVE-2022-2982)

Use After Free in GitHub repository vim/vim prior to 9.0.0286. (CVE-2022-3016)

Use After Free in GitHub repository vim/vim prior to 9.0.0322. (CVE-2022-3037)

Use After Free in GitHub repository vim/vim prior to 9.0.0360. (CVE-2022-3099)

Use After Free in GitHub repository vim/vim prior to 9.0.0389. (CVE-2022-3134)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483. (CVE-2022-3234)

Use After Free in GitHub repository vim/vim prior to 9.0.0490. (CVE-2022-3235)

Use After Free in GitHub repository vim/vim prior to 9.0.0530. (CVE-2022-3256)

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552. (CVE-2022-3278)

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577. (CVE-2022-3296)

Use After Free in GitHub repository vim/vim prior to 9.0.0579. (CVE-2022-3297)

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598. (CVE-2022-3324)

Use After Free in GitHub repository vim/vim prior to 9.0.0614. (CVE-2022-3352)

Affected by this issue is the function qf_update_buffer of the file quickfix.c of the…

These are all security issues fixed in the gvim-9.0.0453-2.1 package on the GA media of openSUSE Tumbleweed.

This update for vim fixes the following issues:

Updated to version 9.0 with patch level 0313:

• CVE-2022-2183: Fixed out-of-bounds read through get_lisp_indent() (bsc#1200902).
• CVE-2022-2182: Fixed heap-based buffer overflow through parse_cmd_address() (bsc#1200903).
• CVE-2022-2175: Fixed buffer over-read through cmdline_insert_reg() (bsc#1200904).
• CVE-2022-2304: Fixed stack buffer overflow in spell_dump_compl() (bsc#1201249).
• CVE-2022-2343: Fixed heap-based buffer overflow in GitHub repository vim prior to 9.0.0044 (bsc#1201356).
• CVE-2022-2344: Fixed another heap-based buffer overflow vim prior to 9.0.0045 (bsc#1201359).
• CVE-2022-2345: Fixed use after free in GitHub repository vim prior to 9.0.0046. (bsc#1201363).
• CVE-2022-2819: Fixed heap-based Buffer Overflow in compile_lock_unlock() (bsc#1202414).
• CVE-2022-2874: Fixed NULL Pointer Dereference in generate_loadvar() (bsc#1202552).
• CVE-2022-1968: Fixed use after free in utf_ptr2char (bsc#1200270).
• CVE-2022-2124: Fixed out of bounds read in current_quote() (bsc#1200697).
• CVE-2022-2125: Fixed out of bounds read in get_lisp_indent() (bsc#1200698).
• CVE-2022-2126: Fixed out of bounds read in suggest_trie_walk() (bsc#1200700).
• CVE-2022-2129: Fixed out of bounds write in vim_regsub_both() (bsc#1200701).
• CVE-2022-1720: Fixed out of bounds read in grab_file_name() (bsc#1200732).
• CVE-2022-2264: Fixed out of bounds read in inc() (bsc#1201132).
• CVE-2022-2284: Fixed out of bounds read in utfc_ptr2len() (bsc#1201133).
• CVE-2022-2285: Fixed negative size passed to memmove() due to integer overflow (bsc#1201134).
• CVE-2022-2286: Fixed out of bounds read in ins_bytes() (bsc#1201135).
• CVE-2022-2287: Fixed out of bounds read in suggest_trie_walk() (bsc#1201136).
• CVE-2022-2231: Fixed null pointer dereference skipwhite() (bsc#1201150).
• CVE-2022-2210: Fixed out of bounds read in ml_append_int() (bsc#1201151).
• CVE-2022-2208: Fixed null pointer dereference in diff_check() (bsc#1201152).
• CVE-2022-2207: Fixed out of bounds read in ins_bs() (bsc#1201153).
• CVE-2022-2257: Fixed out of bounds read in msg_outtrans_special() (bsc#1201154).
• CVE-2022-2206: Fixed out of bounds read in msg_outtrans_attr() (bsc#1201155).
• CVE-2022-2522: Fixed out of bounds read via nested autocommand (bsc#1201863).
• CVE-2022-2571: Fixed heap-based buffer overflow related to ins_comp_get_next_word_or_line() (bsc#1202046).
• CVE-2022-2580: Fixed heap-based buffer overflow related to eval_string() (bsc#1202049).
• CVE-2022-2581: Fixed out-of-bounds read related to cstrchr() (bsc#1202050).
• CVE-2022-2598: Fixed undefined behavior for Input to API related to diff_mark_adjust_tp() and ex_diffgetput() (bsc#1202051).
• CVE-2022-2817: Fixed use after gree in f_assert_fails() (bsc#1202420).
• CVE-2022-2816: Fixed out-of-bounds Read in check_vim9_unlet() (bsc#1202421).
• CVE-2022-2862: Fixed use-after-free in compile_nested_function() (bsc#1202511).
• CVE-2022-2849: Fixed invalid memory access related to mb_ptr2len() (bsc#1202512).
• CVE-2022-2845: Fixed buffer Over-read related to display_dollar() (bsc#1202515).
• CVE-2022-2889: Fixed use-after-free in find_var_also_in_script() in evalvars.c (bsc#1202599).
• CVE-2022-2923: Fixed NULL pointer dereference in GitHub repository vim/vim prior to 9.0.0240 (bsc#1202687).
• CVE-2022-2946: Fixed use after free in function vim_vsnprintf_typval (bsc#1202689).
• CVE-2022-3016: Fixed use after free in vim prior to 9.0.0285 (bsc#1202862).

Bugfixes:

• Fixing vim error on startup (bsc#1200884).
• Fixing vim SUSE Linux Enterprise Server 15 SP4 Basesystem plugin-tlib issue (bsc#1201620).

This update for vim fixes the following issues:

Updated to version 9.0.0814:

• Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
• Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
• Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
• Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
• Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
• Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
• Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
• Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
• Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
• Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
• Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
• Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
• Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
• Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
• Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
• Fixing bsc#1200884 Vim: Error on startup
• Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
• Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
• Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
• Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
• Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
• Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
• Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
• Fixing bsc#1201620 vim: SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
• Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
• Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
• Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
• Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
• Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
• Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
• Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
• Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
• Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
• Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
• Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
• Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
• Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
• Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
• Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
• Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
• Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
• Fixing bsc#1201154 VUL-1:…

It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possible execute arbitrary code. This issue only affected Ubuntu 14.04 ESM, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-0413, CVE-2022-1629, CVE-2022-1674, CVE-2022-1733, CVE-2022-1735, CVE-2022-1785, CVE-2022-1796, CVE-2022-1851, CVE-2022-1898, CVE-2022-1942, CVE-2022-1968, CVE-2022-2124, CVE-2022-2125, CVE-2022-2126, CVE-2022-2129, CVE-2022-2175, CVE-2022-2183, CVE-2022-2206, CVE-2022-2304, CVE-2022-2345, CVE-2022-2581)

It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possible execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1720, CVE-2022-2571, CVE-2022-2845, CVE-2022-2849, CVE-2022-2923)

It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possible execute arbitrary code. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-1927, CVE-2022-2344)

It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possible execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-2946)

It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possible execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-2980)