CVE-2022-3296

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577.

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577.(CVE-2022-3296)

Use After Free in GitHub repository vim/vim prior to 9.0.0614.(CVE-2022-3352)

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577.

• CVE-2022-3296: check CSF_TRY can be found
• CVE-2022-3324: make sure the window width does not become negative

• CVE-2022-3296: check CSF_TRY can be found
• CVE-2022-3324: make sure the window width does not become negative

• SECURITY UPDATE: Buffer underflow with unexpected :finally
  • debian/patches/CVE-2022-3296.patch: Check CSF_TRY can be found
  • CVE-2022-3296
• SECURITY UPDATE: Using negative array index with negative width window
  • debian/patches/CVE-2022-3324.patch: Make sure the window width does not become negative
  • CVE-2022-3324
• Fix Makefile:
  • debian/patches/fix-tests.patch: add some tests

• SECURITY UPDATE: Stack-based Buffer Overflow with unexpected :finally
  • debian/patches/CVE-2022-3296.patch: check CSF_TRY can be found
  • CVE-2022-3296
• Fix Test_terminal_noblock()
  • debian/patches/fix-flaky-terminal-noblock-test.patch

• CVE-2021-3796: fix use-after-free in nv_replace by getting the line pointer again after ins_copychar may have released it
• CVE-2021-3973: fix heap buffer overflow in find_file_in_path_option by rejecting len == 0 inputs
• CVE-2022-0413: fix use-after-free in do_sub when the substitute string is a "=" expression by copying the string before eval
• CVE-2022-0943: fix heap overflow in spell_suggest when "z=" in Visual mode by clamping badlen to the remaining line length
• CVE-2022-1620: fix NULL pointer access by guarding both vim_regexec calls in fname_match and the second fname_match call in buflist_match against rmp->regprog becoming NULL after the AUTOMATIC_ENGINE fallback fails to recompile the pattern
• CVE-2022-1796: fix use-after-free in find_pattern_in_path by making a copy of the identifier pointer before the call
• CVE-2022-2207: fix read-before-start-of-line in ins_bs by requiring w_cursor.col > 0 in the whitespace back-step loop
• CVE-2022-3235: fix use-after-free in cmdline input-method handling by tracking the owning buffer and checking buf_valid
• CVE-2022-3296: fix buffer underflow in ex_finally by searching for a valid CSF_TRY frame before accessing cs_flags
• CVE-2023-46246: fix integer overflow in :history by clamping long values to INT_MAX before casting to int
• CVE-2023-48231: fix use-after-free in win_close by returning early when the window is no longer valid after BufLeave
• CVE-2023-48706: fix use-after-free in ex_substitute by always allocating sub and freeing it on every exit path
• CVE-2026-33412: fix command injection via newline in glob() by adding '\n' to the SHELL_SPECIAL escape set

• CVE-2022-2343: heap-buffer-overflow in ins_compl_add_infercase() on long line with 'infercase' (upstream vim 9.0.0045)
• CVE-2022-3296: stack underflow in ex_finally / ex_endtry when :finally lacks an enclosing :try (upstream vim 9.0.0577)

• CVE-2022-2343: heap-buffer-overflow in ins_compl_add_infercase() on long line with 'infercase' (upstream vim 9.0.0045)
• CVE-2022-3296: stack underflow in ex_finally / ex_endtry when :finally lacks an enclosing :try (upstream vim 9.0.0577)

• CVE-2022-0572: heap overflow on vcol-overflow in :retab (upstream vim 8.2.4359)
• CVE-2022-0368: illegal memory access when undo makes Visual area invalid (upstream vim 8.2.4217)
• CVE-2022-0685: crash on multi-byte char in unix_expandpath() (upstream vim 8.2.4418)
• CVE-2022-2125: heap overflow in get_lisp_indent() (upstream vim 8.2.5122)
• CVE-2022-2183: reading past end-of-line in lisp indenting (upstream vim 8.2.5151)
• CVE-2022-2124: reading past end-of-line in current_quote() (upstream vim 8.2.5120)
• CVE-2022-2344: heap overflow in ins_compl_add() (upstream vim 9.0.0046)
• CVE-2022-3256: use-after-free in movemark() when autocmd changes mark (upstream vim 9.0.0530)
• CVE-2023-4752: heap use-after-free in ins_compl_get_exp() (upstream vim 9.0.1858)
• CVE-2022-2126: spell-suggest read past bad word (upstream vim 8.2.5123)
• CVE-2022-2946: use-after-free in do_tag() when tagfunc invalidates tagstack (upstream vim 9.0.0246)
• CVE-2022-1720: OOB read in get_visual_text() (upstream vim 8.2.4956)
• CVE-2022-3234: OOB write in op_replace() (upstream vim 9.0.0483)
• CVE-2023-0433: same_leader() read past end-of-line on short comment line (upstream vim 9.0.1225)
• CVE-2023-4781: heap-buffer-overflow in vim_regsub_both() via nmatch underflow in :substitute, plus textlock guard in win_exchange() (upstream vim 9.0.1873)
• CVE-2022-0351: crash on deeply nested expression (upstream vim 8.2.4206)
• CVE-2022-2175: new_cmdpos leak across register insertion in getcmdline() (upstream vim 8.2.5148)
• CVE-2026-39881: netbeans command injection via crafted sign/highlight identifier + special-keys (upstream vim 9.2.0316)
• CVE-2021-4166: heap-buffer-overflow when clearing the argument list while it is being used (upstream vim 8.2.3884, with 8.2.2421 + 8.2.2463 prereqs for arglist_locked plumbing)
• CVE-2022-2343: heap-buffer-overflow in ins_compl_add_infercase() on long line with 'infercase' (upstream vim 9.0.0045)
• CVE-2022-3296: stack underflow in ex_finally / ex_endtry when :finally lacks an enclosing :try (upstream vim 9.0.0577)

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. (CVE-2022-2000, CVE-2022-2129, CVE-2022-2210)

Use After Free in GitHub repository vim/vim prior to 8.2. (CVE-2022-2042)

Buffer Over-read in GitHub repository vim/vim prior to 8.2. (CVE-2022-2124, CVE-2022-2175)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. (CVE-2022-2125, CVE-2022-2182, CVE-2022-2207)

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. (CVE-2022-2126, CVE-2022-2183, CVE-2022-2206)

NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163. (CVE-2022-2208)

NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2. (CVE-2022-2231)

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. (CVE-2022-2257, CVE-2022-2286, CVE-2022-2287, CVE-2022-2288)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. (CVE-2022-2264, CVE-2022-2284)

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0. (CVE-2022-2285)

Use After Free in GitHub repository vim/vim prior to 9.0. (CVE-2022-2289)

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. (CVE-2022-2304)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044. (CVE-2022-2343)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045. (CVE-2022-2344)

Use After Free in GitHub repository vim/vim prior to 9.0.0046. (CVE-2022-2345)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061. (CVE-2022-2522)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0101. (CVE-2022-2571)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0102. (CVE-2022-2580)

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0104. (CVE-2022-2581)

Undefined Behavior for Input to API in GitHub repository vim/vim prior to 9.0.0100. (CVE-2022-2598)

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212. (CVE-2022-2816)

Use After Free in GitHub repository vim/vim prior to 9.0.0213. (CVE-2022-2817)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211. (CVE-2022-2819)

Buffer Over-read in GitHub repository vim/vim prior to 9.0.0218. (CVE-2022-2845)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220. (CVE-2022-2849)

Use After Free in GitHub repository vim/vim prior to 9.0.0221. (CVE-2022-2862)

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224. (CVE-2022-2874)

Use After Free in GitHub repository vim/vim prior to 9.0.0225. (CVE-2022-2889)

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240. (CVE-2022-2923)

Use After Free in GitHub repository vim/vim prior to 9.0.0246. (CVE-2022-2946)

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0259. (CVE-2022-2980)

Use After Free in GitHub repository vim/vim prior to 9.0.0260. (CVE-2022-2982)

Use After Free in GitHub repository vim/vim prior to 9.0.0286. (CVE-2022-3016)

Use After Free in GitHub repository vim/vim prior to 9.0.0322. (CVE-2022-3037)

Use After Free in GitHub repository vim/vim prior to 9.0.0360. (CVE-2022-3099)

Use After Free in GitHub repository vim/vim prior to 9.0.0389. (CVE-2022-3134)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483. (CVE-2022-3234)

Use After Free in GitHub repository vim/vim prior to 9.0.0490. (CVE-2022-3235)

Use After Free in GitHub repository vim/vim prior to 9.0.0530. (CVE-2022-3256)

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552. (CVE-2022-3278)

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577. (CVE-2022-3296)

Use After Free in GitHub repository vim/vim prior to 9.0.0579. (CVE-2022-3297)

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598. (CVE-2022-3324)

Use After Free in GitHub repository vim/vim prior to 9.0.0614. (CVE-2022-3352)

Affected by this issue is the function qf_update_buffer of the file quickfix.c of the…

This update for vim fixes the following issues:

Updated to version 9.0 with patch level 0814:

• CVE-2021-3928: Fixed stack-based buffer overflow (bsc#1192478).
• CVE-2022-3234: Fixed heap-based buffer overflow (bsc#1203508).
• CVE-2022-3235: Fixed use-after-free (bsc#1203509).
• CVE-2022-3324: Fixed stack-based buffer overflow (bsc#1203820).
• CVE-2022-3705: Fixed use-after-free in function qf_update_buffer of the file quickfix.c (bsc#1204779).
• CVE-2022-2982: Fixed use-after-free in qf_fill_buffer() (bsc#1203152).
• CVE-2022-3296: Fixed stack out of bounds read in ex_finally() in ex_eval.c (bsc#1203796).
• CVE-2022-3297: Fixed use-after-free in process_next_cpt_value() at insexpand.c (bsc#1203797).
• CVE-2022-3099: Fixed use-after-free in ex_docmd.c (bsc#1203110).
• CVE-2022-3134: Fixed use-after-free in do_tag() (bsc#1203194).
• CVE-2022-3153: Fixed NULL pointer dereference (bsc#1203272).
• CVE-2022-3278: Fixed NULL pointer dereference in eval_next_non_blank() in eval.c (bsc#1203799).
• CVE-2022-3352: Fixed use-after-free (bsc#1203924).
• CVE-2022-2980: Fixed NULL pointer dereference in do_mouse() (bsc#1203155).
• CVE-2022-3037: Fixed use-after-free (bsc#1202962).

This update for vim fixes the following issues:

Updated to version 9.0.0814:

• Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
• Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
• Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
• Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
• Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
• Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
• Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
• Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
• Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
• Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
• Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
• Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
• Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
• Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
• Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
• Fixing bsc#1200884 Vim: Error on startup
• Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
• Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
• Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
• Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
• Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
• Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
• Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
• Fixing bsc#1201620 vim: SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
• Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
• Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
• Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
• Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
• Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
• Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
• Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
• Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
• Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
• Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
• Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
• Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
• Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
• Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
• Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
• Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
• Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
• Fixing bsc#1201154 VUL-1:…