CVE-2022-4292

Use After Free in GitHub repository vim/vim prior to 9.0.0882.

Use After Free in GitHub repository vim/vim prior to 9.0.0882.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing.It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.(CVE-2022-4293)

Use After Free in GitHub repository vim/vim prior to 9.0.0882.(CVE-2022-4292)

Use After Free in GitHub repository vim/vim prior to 9.0.0882.

• CVE-2022-4292: bail out if the window no longer exists

• CVE-2022-4292: bail out if the window no longer exists

• SECURITY UPDATE: Using freed memory after SpellFileMissing autocmd uses bwipe
  • debian/patches/CVE-2022-4292.patch: Bail out if the window no longer exists
  • CVE-2022-4292

• CVE-2022-2175: fix invalid memory access in cmdline_insert_reg() when using an expression on the command line; save/restore new_cmdpos around the expression evaluation (ex_getln.c, upstream patch 8.2.5148; hunk 3 context adjusted for 8.2.2637)
• CVE-2022-3256: fix use-after-free in movemark() when an autocommand changes the mark; make a local copy of the fmark before potentially triggering buffer autocommands (mark.c, upstream patch 9.0.0530)
• CVE-2022-4292: fix use-after-free in did_set_spelllang() when a SpellFileMissing autocommand uses :bwipe to close the current window; also bail out when the window is no longer valid (spell.c, upstream patch 9.0.0882)
• CVE-2022-3324: fix negative-index buffer access caused by negative window width; clamp next_curwin_size in win_equal_rec() and clamp wp->w_width in win_new_width() (window.c, upstream patch 9.0.0598)

• CVE-2022-4292: also check win_valid_any_tab() in did_set_spelllang() after SpellFileMissing autocmd
• CVE-2023-4751: reset_VIsual_and_resel() at start of ex_buffer_all() to prevent UAF on Visual mark
• CVE-2023-0054: bail out of do_string_sub() when vim_regsub() returns sublen <= 0
• CVE-2022-2206: clamp cmdline_row/msg_row to Rows-1 at end of check_shellsize()
• CVE-2023-5535: block_autocmds()/unblock_autocmds() around buf_contents_changed() temp-buffer life
• CVE-2022-2129: tighten do_exedit() check to (textlock != 0 || curbuf_locked()) instead of curbuf_locked() only

This update for vim fixes the following issues:

Updated to version 9.0.1040:

• CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 (bsc#1206028).
• CVE-2022-3520: vim: Heap-based Buffer Overflow (bsc#1206071).
• CVE-2022-3591: vim: Use After Free (bsc#1206072).
• CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882 (bsc#1206075).
• CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804 (bsc#1206077).
• CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 (bsc#1205797).
• CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c (bsc#1204779).

This update for vim fixes the following issues:

• Updated to version 9.0.1234:
  • CVE-2023-0433: Fixed an out of bounds memory access that could cause a crash (bsc#1207396).
  • CVE-2023-0288: Fixed an out of bounds memory access that could cause a crash (bsc#1207162).
  • CVE-2023-0054: Fixed an out of bounds memory write that could cause a crash or memory corruption (bsc#1206868).
  • CVE-2023-0051: Fixed an out of bounds memory access that could cause a crash (bsc#1206867).
  • CVE-2023-0049: Fixed an out of bounds memory access that could cause a crash (bsc#1206866).
  • CVE-2022-3491: Fixed an out of bounds memory access that could cause a crash (bsc#1206028).
  • CVE-2022-3520: Fixed an out of bounds memory access that could cause a crash (bsc#1206071).
  • CVE-2022-3591: Fixed a use-after-free issue that could cause memory corruption or undefined behavior (bsc#1206072).
  • CVE-2022-4292: Fixed a use-after-free issue that could cause memory corruption or undefined behavior (bsc#1206075).
  • CVE-2022-4293: Fixed a floating point exception that could cause a crash (bsc#1206077).
  • CVE-2022-4141: Fixed an out of bounds memory write that could cause a crash or memory corruption (bsc#1205797).
  • CVE-2022-3705: Fixed an use-after-free issue that could cause a crash or memory corruption (bsc#1204779).

It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-3235, CVE-2022-3278, CVE-2022-3297, CVE-2022-3491)

It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-3352, CVE-2022-4292)

It was discovered that Vim incorrectly handled memory when replacing in virtualedit mode. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-3234)

It was discovered that Vim incorrectly handled memory when autocmd changes mark. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-3256)

It was discovered that Vim did not properly perform checks on array index with negative width window. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. (CVE-2022-3324)

It was discovered that Vim did not properly perform checks on a put command column with a visual block. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-3520)

It was discovered that Vim incorrectly handled memory when using autocommand to open a window. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-3591)

It was discovered that Vim incorrectly handled memory when updating buffer of the component autocmd handler. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-3705)

It was discovered that Vim incorrectly handled floating point comparison with incorrect operator. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. and Ubuntu 22.04 LTS. (CVE-2022-4293)