CVE-2021-3778

vim is vulnerable to Heap-based Buffer Overflow

vim is vulnerable to Heap-based Buffer Overflow

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

vim is vulnerable to Heap-based Buffer Overflow(CVE-2021-3778)

vim is vulnerable to Use After Free(CVE-2021-3796)

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c (CVE-2021-3778)

• vim: use-after-free in nv_replace() in normal.c (CVE-2021-3796)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

vim is vulnerable to Heap-based Buffer Overflow

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c (CVE-2021-3778)

• vim: use-after-free in nv_replace() in normal.c (CVE-2021-3796)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2021-3778: crafted input leads to heap-based buffer overflow
• CVE-2021-3796: crafted input leads to use-after-free

• CVE-2021-3778: crafted input leads to heap-based buffer overflow
• CVE-2021-3796: crafted input leads to use-after-free

• CVE-2022-2182: in do_one_cmd(), after ";" sets curwin->w_cursor.lnum to ea.line2, call check_cursor() instead of check_cursor_lnum() so the column is validated too, and fall back to check_cursor_col() when ea.line2 is zero, preventing read past end-of-line on ":0;'{".
• CVE-2022-2206: in check_shellsize(), clamp cmdline_row and msg_row to Rows - 1 after limit_screen_size() so a shrinking terminal cannot leave those values referencing freed screen rows.
• CVE-2022-2257: in str2special(), when the byte is single-byte set *sp = str + (*str == NUL ? 0 : 1) so the caller cannot walk past the terminating NUL when a menu item ends in a modifier-only key.
• CVE-2022-2849: in latin_ptr2len()/dbcs_ptr2len(), return 0 when *p == NUL so loops that advance by mb_ptr2len() cannot walk past the NUL terminator (matches the contract documented in src/globals.h).
• CVE-2022-3352: in spell_load_lang(), snapshot curbuf before the SpellFileMissing autocommand and break out of the retry loop if the autocommand deleted/replaced curbuf, preventing a use-after-free on the cached "lang"/"curbuf" pointer. Uses sl.sl_lang (stack copy) for the apply_autocmds pattern to survive buffer deletion.
• CVE-2023-2609: in get_register() (ops.c), treat y_current->y_array == NULL the same as y_size == 0 and set reg->y_array to NULL, so an invalid/NULL register contents cannot be walked as a valid string vector.
• CVE-2021-3778: in find_match_text() (regexp_nfa.c), advance by utf_ptr2len(regline + col + len2) under enc_utf8 instead of MB_CHAR2LEN(c2), so an invalid UTF-8 byte cannot cause a read past the end of the line.
• CVE-2022-1616: in append_command() (ex_docmd.c), change the buffer-space check to "d - IObuff + 5 < IOSIZE" and skip copying a multibyte character whose length would overrun IObuff, so an invalid command with composing chars cannot overflow the error- message buffer.
• CVE-2022-1897: in undo_time() (undo.c), call text_locked() / text_locked_msg() and return early, so :undo / :earlier / g- cannot run while the text is locked (e.g. inside a :substitute callback) and free a buffer the caller is still walking.
• CVE-2022-2125: in get_lisp_indent() (misc1.c), after the double-quoted-string skip loop break out of the outer scan loop when *that is NUL so lisp indenting cannot walk past end-of-line on an unterminated quote.

• CVE-2022-2182: in do_one_cmd(), after ";" sets curwin->w_cursor.lnum to ea.line2, call check_cursor() instead of check_cursor_lnum() so the column is validated too, and fall back to check_cursor_col() when ea.line2 is zero, preventing read past end-of-line on ":0;'{".
• CVE-2022-2206: in check_shellsize(), clamp cmdline_row and msg_row to Rows - 1 after limit_screen_size() so a shrinking terminal cannot leave those values referencing freed screen rows.
• CVE-2022-2257: in str2special(), when the byte is single-byte set *sp = str + (*str == NUL ? 0 : 1) so the caller cannot walk past the terminating NUL when a menu item ends in a modifier-only key.
• CVE-2022-2849: in latin_ptr2len()/dbcs_ptr2len(), return 0 when *p == NUL so loops that advance by mb_ptr2len() cannot walk past the NUL terminator (matches the contract documented in src/globals.h).
• CVE-2022-3352: in spell_load_lang(), snapshot curbuf before the SpellFileMissing autocommand and break out of the retry loop if the autocommand deleted/replaced curbuf, preventing a use-after-free on the cached "lang"/"curbuf" pointer. Uses sl.sl_lang (stack copy) for the apply_autocmds pattern to survive buffer deletion.
• CVE-2023-2609: in get_register() (ops.c), treat y_current->y_array == NULL the same as y_size == 0 and set reg->y_array to NULL, so an invalid/NULL register contents cannot be walked as a valid string vector.
• CVE-2021-3778: in find_match_text() (regexp_nfa.c), advance by utf_ptr2len(regline + col + len2) under enc_utf8 instead of MB_CHAR2LEN(c2), so an invalid UTF-8 byte cannot cause a read past the end of the line.
• CVE-2022-1616: in append_command() (ex_docmd.c), change the buffer-space check to "d - IObuff + 5 < IOSIZE" and skip copying a multibyte character whose length would overrun IObuff, so an invalid command with composing chars cannot overflow the error- message buffer.
• CVE-2022-1897: in undo_time() (undo.c), call text_locked() / text_locked_msg() and return early, so :undo / :earlier / g- cannot run while the text is locked (e.g. inside a :substitute callback) and free a buffer the caller is still walking.
• CVE-2022-2125: in get_lisp_indent() (misc1.c), after the double-quoted-string skip loop break out of the outer scan loop when *that is NUL so lisp indenting cannot walk past end-of-line on an unterminated quote.

CVE-2021-3778: vim: Heap-based Buffer Overflow in utf_ptr2char() Fix: patch 8.2.3409: reading beyond end of line with invalid utf-8 character When vim 8.2 is built with --with-features=huge --enable-gui=none and address sanitizer, a heap-buffer overflow occurs when running: echo "Ywp2XTCqCi4KeQpAMA==" | base64 -d > fuzz000.txt vim -u NONE -X -Z -e -s -S fuzz000.txt -c :qa!

CVE-2021-3796: vim: Use After Free in nv_replace() Fix: patch 8.2.3428: using freed memory when replacing When vim 8.2 is built with --with-features=huge --enable-gui=none and address sanitizer, a use-after-free occurs when running: LC_ALL=C vim -U NONE -X -Z -e -s -S poc -c :qa! with the poc file provided.

This update for vim fixes the following issues:

• CVE-2022-0318: Fixed heap-based buffer overflow (bsc#1195004).
• CVE-2021-3796: Fixed use-after-free in nv_replace() in normal.c (bsc#1190570).
• CVE-2021-3872: Fixed heap-based buffer overflow in win_redr_status() drawscreen.c (bsc#1191893).
• CVE-2021-3927: Fixed heap-based buffer overflow (bsc#1192481).
• CVE-2021-3928: Fixed stack-based buffer overflow (bsc#1192478).
• CVE-2021-4019: Fixed heap-based buffer overflow (bsc#1193294).
• CVE-2021-3984: Fixed illegal memory access when C-indenting could have led to heap buffer overflow (bsc#1193298).
• CVE-2021-3778: Fixed heap-based buffer overflow in regexp_nfa.c (bsc#1190533).
• CVE-2021-4193: Fixed out-of-bounds read (bsc#1194216).
• CVE-2021-46059: Fixed pointer dereference vulnerability via the vim_regexec_multi function at regexp.c (bsc#1194556).
• CVE-2022-0319: Fixded out-of-bounds read (bsc#1195066).
• CVE-2022-0351: Fixed uncontrolled recursion in eval7() (bsc#1195126).
• CVE-2022-0361: Fixed buffer overflow (bsc#1195126).
• CVE-2022-0413: Fixed use-after-free in src/ex_cmds.c (bsc#1195356).

This update for vim fixes the following issues:

• CVE-2022-0318: Fixed heap-based buffer overflow (bsc#1195004).
• CVE-2021-3796: Fixed use-after-free in nv_replace() in normal.c (bsc#1190570).
• CVE-2021-3872: Fixed heap-based buffer overflow in win_redr_status() drawscreen.c (bsc#1191893).
• CVE-2021-3927: Fixed heap-based buffer overflow (bsc#1192481).
• CVE-2021-3928: Fixed stack-based buffer overflow (bsc#1192478).
• CVE-2021-4019: Fixed heap-based buffer overflow (bsc#1193294).
• CVE-2021-3984: Fixed illegal memory access when C-indenting could have led to heap buffer overflow (bsc#1193298).
• CVE-2021-3778: Fixed heap-based buffer overflow in regexp_nfa.c (bsc#1190533).
• CVE-2021-4193: Fixed out-of-bounds read (bsc#1194216).
• CVE-2021-46059: Fixed pointer dereference vulnerability via the vim_regexec_multi function at regexp.c (bsc#1194556).
• CVE-2022-0319: Fixded out-of-bounds read (bsc#1195066).
• CVE-2022-0351: Fixed uncontrolled recursion in eval7() (bsc#1195126).
• CVE-2022-0361: Fixed buffer overflow (bsc#1195126).
• CVE-2022-0413: Fixed use-after-free in src/ex_cmds.c (bsc#1195356).

This update for vim fixes the following issues:

• CVE-2022-0318: Fixed heap-based buffer overflow (bsc#1195004).
• CVE-2021-3796: Fixed use-after-free in nv_replace() in normal.c (bsc#1190570).
• CVE-2021-3872: Fixed heap-based buffer overflow in win_redr_status() drawscreen.c (bsc#1191893).
• CVE-2021-3927: Fixed heap-based buffer overflow (bsc#1192481).
• CVE-2021-3928: Fixed stack-based buffer overflow (bsc#1192478).
• CVE-2021-4019: Fixed heap-based buffer overflow (bsc#1193294).
• CVE-2021-3984: Fixed illegal memory access when C-indenting could have led to heap buffer overflow (bsc#1193298).
• CVE-2021-3778: Fixed heap-based buffer overflow in regexp_nfa.c (bsc#1190533).
• CVE-2021-4193: Fixed out-of-bounds read (bsc#1194216).
• CVE-2021-46059: Fixed pointer dereference vulnerability via the vim_regexec_multi function at regexp.c (bsc#1194556).
• CVE-2022-0319: Fixded out-of-bounds read (bsc#1195066).
• CVE-2022-0351: Fixed uncontrolled recursion in eval7() (bsc#1195126).
• CVE-2022-0361: Fixed buffer overflow (bsc#1195126).
• CVE-2022-0413: Fixed use-after-free in src/ex_cmds.c (bsc#1195356).

This update for vim fixes the following issues:

• CVE-2017-17087: Fixed information leak via .swp files (bsc#1070955).
• CVE-2021-3875: Fixed heap-based buffer overflow (bsc#1191770).
• CVE-2021-3903: Fixed heap-based buffer overflow (bsc#1192167).
• CVE-2021-3968: Fixed heap-based buffer overflow (bsc#1192902).
• CVE-2021-3973: Fixed heap-based buffer overflow (bsc#1192903).
• CVE-2021-3974: Fixed use-after-free (bsc#1192904).
• CVE-2021-4069: Fixed use-after-free in ex_open()in src/ex_docmd.c (bsc#1193466).
• CVE-2021-4136: Fixed heap-based buffer overflow (bsc#1193905).
• CVE-2021-4166: Fixed out-of-bounds read (bsc#1194093).
• CVE-2021-4192: Fixed use-after-free (bsc#1194217).
• CVE-2021-4193: Fixed out-of-bounds read (bsc#1194216).
• CVE-2022-0128: Fixed out-of-bounds read (bsc#1194388).
• CVE-2022-0213: Fixed heap-based buffer overflow (bsc#1194885).
• CVE-2022-0261: Fixed heap-based buffer overflow (bsc#1194872).
• CVE-2022-0318: Fixed heap-based buffer overflow (bsc#1195004).
• CVE-2022-0359: Fixed heap-based buffer overflow in init_ccline() in ex_getln.c (bsc#1195203).
• CVE-2022-0392: Fixed heap-based buffer overflow (bsc#1195332).
• CVE-2022-0407: Fixed heap-based buffer overflow (bsc#1195354).
• CVE-2022-0696: Fixed NULL pointer dereference (bsc#1196361).
• CVE-2022-1381: Fixed global heap buffer overflow in skip_range (bsc#1198596).
• CVE-2022-1420: Fixed out-of-range pointer offset (bsc#1198748).
• CVE-2022-1616: Fixed use-after-free in append_command (bsc#1199331).
• CVE-2022-1619: Fixed heap-based Buffer Overflow in function cmdline_erase_chars (bsc#1199333).
• CVE-2022-1620: Fixed NULL pointer dereference in function vim_regexec_string (bsc#1199334).
• CVE-2022-1733: Fixed heap-based buffer overflow in cindent.c (bsc#1199655).
• CVE-2022-1735: Fixed heap-based buffer overflow (bsc#1199651).
• CVE-2022-1771: Fixed stack exhaustion (bsc#1199693).
• CVE-2022-1785: Fixed out-of-bounds write (bsc#1199745).
• CVE-2022-1796: Fixed use-after-free in find_pattern_in_path (bsc#1199747).
• CVE-2022-1851: Fixed out-of-bounds read (bsc#1199936).
• CVE-2022-1897: Fixed out-of-bounds write (bsc#1200010).
• CVE-2022-1898: Fixed use-after-free (bsc#1200011).
• CVE-2022-1927: Fixed buffer over-read (bsc#1200012).

This update for vim fixes the following issues:

Updated to version 9.0.0814:

• Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
• Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
• Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
• Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
• Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
• Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
• Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
• Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
• Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
• Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
• Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
• Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
• Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
• Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
• Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
• Fixing bsc#1200884 Vim: Error on startup
• Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
• Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
• Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
• Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
• Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
• Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
• Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
• Fixing bsc#1201620 vim: SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
• Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
• Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
• Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
• Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
• Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
• Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
• Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
• Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
• Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
• Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
• Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
• Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
• Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
• Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
• Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
• Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
• Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
• Fixing bsc#1201154 VUL-1:…

Brian Carpenter discovered that vim incorrectly handled memory when opening certain files. If a user was tricked into opening a specially crafted file, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges. This issue only affected Ubuntu 20.04 LTS and Ubuntu 21.04. (CVE-2021-3770)

Brian Carpenter discovered that vim incorrectly handled memory when opening certain files. If a user was tricked into opening a specially crafted file, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges. (CVE-2021-3778)

Dhiraj Mishra discovered that vim incorrectly handled memory when opening certain files. If a user was tricked into opening a specially crafted file, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges. (CVE-2021-3796)