CVE-2022-4141

Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command.

Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing.It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command.(CVE-2022-4141)

Use After Free in GitHub repository vim/vim prior to 9.0.0789.(CVE-2022-3591)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765.(CVE-2022-3520)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742.(CVE-2022-3491)

Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command.

• CVE-2022-4141: check for text locked in CTRL-W gf
• CVE-2022-3520: check that the column does not become negative

• SECURITY UPDATE: With a Visual block a put command column may go negative
  • debian/patches/CVE-2022-3520.patch: Check that the column does not become negative
  • CVE-2022-3520
• SECURITY UPDATE: Invalid memory access in substitute with function that goes to another file
  • debian/patches/CVE-2022-4141.patch: Check for text locked in CTRL-W gf
  • CVE-2022-4141

• CVE-2022-4141: check for text locked in CTRL-W gf
• CVE-2022-3520: check that the column does not become negative

• SECURITY UPDATE: crash when clearing the argument list while using it
  • debian/patches/CVE-2021-4166.patch: lock the argument list for ":all"; matches upstream patch 8.2.3884.
  • CVE-2021-4166
• SECURITY UPDATE: reading past end of completion with a long line
  • debian/patches/CVE-2022-2343.patch: build the inferred-case text in a growarray when it outgrows IObuff; matches upstream patch 9.0.0045.
  • CVE-2022-2343
• SECURITY UPDATE: memory access errors when calling setloclist() in an autocommand
  • debian/patches/CVE-2022-3016.patch: give an error if the list was changed unexpectedly and drop the stale pointer instead of storing it back; matches upstream patches 8.2.1677 and 9.0.0286.
  • CVE-2022-3016
• SECURITY UPDATE: SpellFileMissing autocmd may delete buffer
  • debian/patches/CVE-2022-3352.patch: disallow deleting the current buffer while loading a spell file; matches upstream patch 9.0.0614.
  • CVE-2022-3352
• SECURITY UPDATE: filetype autocmd may cause freed memory access
  • debian/patches/CVE-2022-3705.patch: set the quickfix-busy flag while filling the buffer; matches upstream patch 9.0.0805.
  • CVE-2022-3705
• SECURITY UPDATE: invalid memory access in substitute with function
  • debian/patches/CVE-2022-4141.patch: check for text or buffer being locked before jumping to a file; matches upstream patch 9.0.0947.
  • CVE-2022-4141

Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command. (CVE-2022-4141)

This update for vim fixes the following issues:

Updated to version 9.0.1040:

• CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 (bsc#1206028).
• CVE-2022-3520: vim: Heap-based Buffer Overflow (bsc#1206071).
• CVE-2022-3591: vim: Use After Free (bsc#1206072).
• CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882 (bsc#1206075).
• CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804 (bsc#1206077).
• CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 (bsc#1205797).
• CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c (bsc#1204779).

This update for vim fixes the following issues:

• Updated to version 9.0.1234:
  • CVE-2023-0433: Fixed an out of bounds memory access that could cause a crash (bsc#1207396).
  • CVE-2023-0288: Fixed an out of bounds memory access that could cause a crash (bsc#1207162).
  • CVE-2023-0054: Fixed an out of bounds memory write that could cause a crash or memory corruption (bsc#1206868).
  • CVE-2023-0051: Fixed an out of bounds memory access that could cause a crash (bsc#1206867).
  • CVE-2023-0049: Fixed an out of bounds memory access that could cause a crash (bsc#1206866).
  • CVE-2022-3491: Fixed an out of bounds memory access that could cause a crash (bsc#1206028).
  • CVE-2022-3520: Fixed an out of bounds memory access that could cause a crash (bsc#1206071).
  • CVE-2022-3591: Fixed a use-after-free issue that could cause memory corruption or undefined behavior (bsc#1206072).
  • CVE-2022-4292: Fixed a use-after-free issue that could cause memory corruption or undefined behavior (bsc#1206075).
  • CVE-2022-4293: Fixed a floating point exception that could cause a crash (bsc#1206077).
  • CVE-2022-4141: Fixed an out of bounds memory write that could cause a crash or memory corruption (bsc#1205797).
  • CVE-2022-3705: Fixed an use-after-free issue that could cause a crash or memory corruption (bsc#1204779).