CVE-2022-3520

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing.It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command.(CVE-2022-4141)

Use After Free in GitHub repository vim/vim prior to 9.0.0789.(CVE-2022-3591)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765.(CVE-2022-3520)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742.(CVE-2022-3491)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765.

• CVE-2022-4141: check for text locked in CTRL-W gf
• CVE-2022-3520: check that the column does not become negative

• SECURITY UPDATE: With a Visual block a put command column may go negative
  • debian/patches/CVE-2022-3520.patch: Check that the column does not become negative
  • CVE-2022-3520
• SECURITY UPDATE: Invalid memory access in substitute with function that goes to another file
  • debian/patches/CVE-2022-4141.patch: Check for text locked in CTRL-W gf
  • CVE-2022-4141

• CVE-2022-4141: check for text locked in CTRL-W gf
• CVE-2022-3520: check that the column does not become negative

• SECURITY UPDATE: Heap-based Buffer Overflow in visual mode
  • debian/patches/CVE-2022-3520.patch: check that the column does not become negative
  • CVE-2022-3520

• CVE-2021-3903: do not set VALID_BOTLINE in w_valid when the screen is not valid, preventing invalid memory access while scrolling.
• CVE-2021-4069: copy the current line before regexec in ex_open() so the match is not using freed memory when searching for a mark flushes it.
• CVE-2022-0351: limit eval7() recursion to 1000 levels to prevent a stack overflow from many nested "(" in an expression.
• CVE-2022-2129: disallow switching buffers in a substitute expression by extending the do_exedit() lock check to cover textlock as well.
• CVE-2022-2183: avoid reading past the NUL terminator in get_lisp_indent().
• CVE-2022-2287: reject words containing control characters or a trailing slash before adding them to the internal spell word list.
• CVE-2022-3234: guard PBYTE against the cursor landing past the NUL in op_replace() with virtualedit, and skip the virtualedit coladd branch when a replacement has already happened.
• CVE-2022-3520: clamp b_op_end.col to zero in do_put() to prevent a negative column with Visual block put.
• CVE-2022-3591: disallow navigating to a dummy buffer in do_buffer() to prevent use-after-free.

• CVE-2022-3520: fix heap buffer overflow in do_put() when Visual-block put causes the end-column to underflow to a negative value

• CVE-2021-3903: do not set VALID_BOTLINE in w_valid when the screen is not valid, preventing invalid memory access while scrolling.
• CVE-2021-4069: copy the current line before regexec in ex_open() so the match is not using freed memory when searching for a mark flushes it.
• CVE-2022-0351: limit eval7() recursion to 1000 levels to prevent a stack overflow from many nested "(" in an expression.
• CVE-2022-2129: disallow switching buffers in a substitute expression by extending the do_exedit() lock check to cover textlock as well.
• CVE-2022-2183: avoid reading past the NUL terminator in get_lisp_indent().
• CVE-2022-2287: reject words containing control characters or a trailing slash before adding them to the internal spell word list.
• CVE-2022-3234: guard PBYTE against the cursor landing past the NUL in op_replace() with virtualedit, and skip the virtualedit coladd branch when a replacement has already happened.
• CVE-2022-3520: clamp b_op_end.col to zero in do_put() to prevent a negative column with Visual block put.
• CVE-2022-3591: disallow navigating to a dummy buffer in do_buffer() to prevent use-after-free.

• CVE-2022-3520: fix heap buffer overflow in do_put() when Visual-block put causes the end-column to underflow to a negative value

• CVE-2022-0261: fix heap-based buffer overflow in block_insert() in src/ops.c
• CVE-2022-0318: fix heap-based buffer overflow in utf_head_off() in mbyte.c
• CVE-2022-3520: clamp b_op_end.col >= 0 in do_put() to prevent Visual block put underflow

• CVE-2022-3520: clamp b_op_end.col >= 0 in do_put() to prevent Visual block put underflow

• CVE-2022-0261: fix heap-based buffer overflow in block_insert() in src/ops.c
• CVE-2022-0318: fix heap-based buffer overflow in utf_head_off() in mbyte.c
• CVE-2022-3520: clamp b_op_end.col >= 0 in do_put() to prevent Visual block put underflow

• SECURITY UPDATE: out-of-bounds read after a Visual block put: do_put() set the '] mark as bd.textcol + totlen - 1 without a lower bound, so a blockwise register whose lines are all empty (y_width becomes -1 in str_to_reg(), giving totlen 0) left the column at -1. With 'selection' set to exclusive, nv_put() then passed that mark to inc(), which dereferenced a pointer before the start of the line buffer.
  • debian/patches/CVE-2022-3520.patch: clamp curbuf->b_op_end.col to 0 in src/ops.c; matches upstream patch 9.0.0765.
  • CVE-2022-3520

This update for vim fixes the following issues:

Updated to version 9.0.1040:

• CVE-2022-3491: vim: Heap-based Buffer Overflow prior to 9.0.0742 (bsc#1206028).
• CVE-2022-3520: vim: Heap-based Buffer Overflow (bsc#1206071).
• CVE-2022-3591: vim: Use After Free (bsc#1206072).
• CVE-2022-4292: vim: Use After Free in GitHub repository vim/vim prior to 9.0.0882 (bsc#1206075).
• CVE-2022-4293: vim: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804 (bsc#1206077).
• CVE-2022-4141: vim: heap-buffer-overflow in alloc.c 246:11 (bsc#1205797).
• CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c (bsc#1204779).

This update for vim fixes the following issues:

• Updated to version 9.0.1234:
  • CVE-2023-0433: Fixed an out of bounds memory access that could cause a crash (bsc#1207396).
  • CVE-2023-0288: Fixed an out of bounds memory access that could cause a crash (bsc#1207162).
  • CVE-2023-0054: Fixed an out of bounds memory write that could cause a crash or memory corruption (bsc#1206868).
  • CVE-2023-0051: Fixed an out of bounds memory access that could cause a crash (bsc#1206867).
  • CVE-2023-0049: Fixed an out of bounds memory access that could cause a crash (bsc#1206866).
  • CVE-2022-3491: Fixed an out of bounds memory access that could cause a crash (bsc#1206028).
  • CVE-2022-3520: Fixed an out of bounds memory access that could cause a crash (bsc#1206071).
  • CVE-2022-3591: Fixed a use-after-free issue that could cause memory corruption or undefined behavior (bsc#1206072).
  • CVE-2022-4292: Fixed a use-after-free issue that could cause memory corruption or undefined behavior (bsc#1206075).
  • CVE-2022-4293: Fixed a floating point exception that could cause a crash (bsc#1206077).
  • CVE-2022-4141: Fixed an out of bounds memory write that could cause a crash or memory corruption (bsc#1205797).
  • CVE-2022-3705: Fixed an use-after-free issue that could cause a crash or memory corruption (bsc#1204779).

It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-3235, CVE-2022-3278, CVE-2022-3297, CVE-2022-3491)

It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-3352, CVE-2022-4292)

It was discovered that Vim incorrectly handled memory when replacing in virtualedit mode. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-3234)

It was discovered that Vim incorrectly handled memory when autocmd changes mark. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-3256)

It was discovered that Vim did not properly perform checks on array index with negative width window. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. (CVE-2022-3324)

It was discovered that Vim did not properly perform checks on a put command column with a visual block. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-3520)

It was discovered that Vim incorrectly handled memory when using autocommand to open a window. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-3591)

It was discovered that Vim incorrectly handled memory when updating buffer of the component autocmd handler. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-3705)

It was discovered that Vim incorrectly handled floating point comparison with incorrect operator. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. and Ubuntu 22.04 LTS. (CVE-2022-4293)