CVE-2022-1897

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.(CVE-2022-1851)

Use After Free in GitHub repository vim/vim prior to 8.2.(CVE-2022-1898)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.(CVE-2022-1942)

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.(CVE-2022-1897)

Use After Free in GitHub repository vim/vim prior to 8.2.(CVE-2022-1968)

Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975.(CVE-2022-1771)

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Out-of-bounds Write (CVE-2022-1785)

• vim: out-of-bounds write in vim_regsub_both() in regexp.c (CVE-2022-1897)

• vim: buffer over-read in utf_ptr2char() in mbyte.c (CVE-2022-1927)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Out-of-bounds Write (CVE-2022-1785)

• vim: out-of-bounds write in vim_regsub_both() in regexp.c (CVE-2022-1897)

• vim: buffer over-read in utf_ptr2char() in mbyte.c (CVE-2022-1927)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es):

• vim: Out-of-bounds Write (CVE-2022-1785)
• vim: out-of-bounds write in vim_regsub_both() in regexp.c (CVE-2022-1897)
• vim: buffer over-read in utf_ptr2char() in mbyte.c (CVE-2022-1927) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es):

• vim: Out-of-bounds Write (CVE-2022-1785)
• vim: out-of-bounds write in vim_regsub_both() in regexp.c (CVE-2022-1897)
• vim: buffer over-read in utf_ptr2char() in mbyte.c (CVE-2022-1927) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2022-1897: fix substitution which overwrites an allocated buffer
• CVE-2022-1927: fix invalid cursor position after '0;' range

• SECURITY UPDATE: Crash with weird 'vartabstop' value
  • debian/patches/CVE-2022-0714.patch: Check for running into the end of the line
  • CVE-2022-0714
• SECURITY UPDATE: Substitute overwrites allocated buffer
  • debian/patches/CVE-2022-1897.patch: Disallow undo when in a substitute command
  • CVE-2022-1897
• SECURITY UPDATE: Cursor position may be invalid after "0;" range
  • debian/patches/CVE-2022-1927.patch: Check the cursor position when it was set by ";" in the range
  • CVE-2022-1886

• CVE-2022-1897: fix substitution which overwrites an allocated buffer
• CVE-2022-1927: fix invalid cursor position after '0;' range

• CVE-2022-2182: in do_one_cmd(), after ";" sets curwin->w_cursor.lnum to ea.line2, call check_cursor() instead of check_cursor_lnum() so the column is validated too, and fall back to check_cursor_col() when ea.line2 is zero, preventing read past end-of-line on ":0;'{".
• CVE-2022-2206: in check_shellsize(), clamp cmdline_row and msg_row to Rows - 1 after limit_screen_size() so a shrinking terminal cannot leave those values referencing freed screen rows.
• CVE-2022-2257: in str2special(), when the byte is single-byte set *sp = str + (*str == NUL ? 0 : 1) so the caller cannot walk past the terminating NUL when a menu item ends in a modifier-only key.
• CVE-2022-2849: in latin_ptr2len()/dbcs_ptr2len(), return 0 when *p == NUL so loops that advance by mb_ptr2len() cannot walk past the NUL terminator (matches the contract documented in src/globals.h).
• CVE-2022-3352: in spell_load_lang(), snapshot curbuf before the SpellFileMissing autocommand and break out of the retry loop if the autocommand deleted/replaced curbuf, preventing a use-after-free on the cached "lang"/"curbuf" pointer. Uses sl.sl_lang (stack copy) for the apply_autocmds pattern to survive buffer deletion.
• CVE-2023-2609: in get_register() (ops.c), treat y_current->y_array == NULL the same as y_size == 0 and set reg->y_array to NULL, so an invalid/NULL register contents cannot be walked as a valid string vector.
• CVE-2021-3778: in find_match_text() (regexp_nfa.c), advance by utf_ptr2len(regline + col + len2) under enc_utf8 instead of MB_CHAR2LEN(c2), so an invalid UTF-8 byte cannot cause a read past the end of the line.
• CVE-2022-1616: in append_command() (ex_docmd.c), change the buffer-space check to "d - IObuff + 5 < IOSIZE" and skip copying a multibyte character whose length would overrun IObuff, so an invalid command with composing chars cannot overflow the error- message buffer.
• CVE-2022-1897: in undo_time() (undo.c), call text_locked() / text_locked_msg() and return early, so :undo / :earlier / g- cannot run while the text is locked (e.g. inside a :substitute callback) and free a buffer the caller is still walking.
• CVE-2022-2125: in get_lisp_indent() (misc1.c), after the double-quoted-string skip loop break out of the outer scan loop when *that is NUL so lisp indenting cannot walk past end-of-line on an unterminated quote.

• CVE-2022-2182: in do_one_cmd(), after ";" sets curwin->w_cursor.lnum to ea.line2, call check_cursor() instead of check_cursor_lnum() so the column is validated too, and fall back to check_cursor_col() when ea.line2 is zero, preventing read past end-of-line on ":0;'{".
• CVE-2022-2206: in check_shellsize(), clamp cmdline_row and msg_row to Rows - 1 after limit_screen_size() so a shrinking terminal cannot leave those values referencing freed screen rows.
• CVE-2022-2257: in str2special(), when the byte is single-byte set *sp = str + (*str == NUL ? 0 : 1) so the caller cannot walk past the terminating NUL when a menu item ends in a modifier-only key.
• CVE-2022-2849: in latin_ptr2len()/dbcs_ptr2len(), return 0 when *p == NUL so loops that advance by mb_ptr2len() cannot walk past the NUL terminator (matches the contract documented in src/globals.h).
• CVE-2022-3352: in spell_load_lang(), snapshot curbuf before the SpellFileMissing autocommand and break out of the retry loop if the autocommand deleted/replaced curbuf, preventing a use-after-free on the cached "lang"/"curbuf" pointer. Uses sl.sl_lang (stack copy) for the apply_autocmds pattern to survive buffer deletion.
• CVE-2023-2609: in get_register() (ops.c), treat y_current->y_array == NULL the same as y_size == 0 and set reg->y_array to NULL, so an invalid/NULL register contents cannot be walked as a valid string vector.
• CVE-2021-3778: in find_match_text() (regexp_nfa.c), advance by utf_ptr2len(regline + col + len2) under enc_utf8 instead of MB_CHAR2LEN(c2), so an invalid UTF-8 byte cannot cause a read past the end of the line.
• CVE-2022-1616: in append_command() (ex_docmd.c), change the buffer-space check to "d - IObuff + 5 < IOSIZE" and skip copying a multibyte character whose length would overrun IObuff, so an invalid command with composing chars cannot overflow the error- message buffer.
• CVE-2022-1897: in undo_time() (undo.c), call text_locked() / text_locked_msg() and return early, so :undo / :earlier / g- cannot run while the text is locked (e.g. inside a :substitute callback) and free a buffer the caller is still walking.
• CVE-2022-2125: in get_lisp_indent() (misc1.c), after the double-quoted-string skip loop break out of the outer scan loop when *that is NUL so lisp indenting cannot walk past end-of-line on an unterminated quote.

out-of-bounds read in gchar_cursor() in misc1.c (CVE-2022-1851) use-after-free in find_pattern_in_path() in search.c (CVE-2022-1898) out-of-bounds write in vim_regsub_both() in regexp.c (CVE-2022-1897) buffer over-read in utf_ptr2char() in mbyte.c (CVE-2022-1927 ) out of bounds write in vim_regsub_both() (CVE-2022-1942) heap-based buffer overflow in function utf_head_off (CVE-2022-1886)

These are all security issues fixed in the gvim-9.0.0453-2.1 package on the GA media of openSUSE Tumbleweed.

This update for vim fixes the following issues:

• CVE-2017-17087: Fixed information leak via .swp files (bsc#1070955).
• CVE-2021-3875: Fixed heap-based buffer overflow (bsc#1191770).
• CVE-2021-3903: Fixed heap-based buffer overflow (bsc#1192167).
• CVE-2021-3968: Fixed heap-based buffer overflow (bsc#1192902).
• CVE-2021-3973: Fixed heap-based buffer overflow (bsc#1192903).
• CVE-2021-3974: Fixed use-after-free (bsc#1192904).
• CVE-2021-4069: Fixed use-after-free in ex_open()in src/ex_docmd.c (bsc#1193466).
• CVE-2021-4136: Fixed heap-based buffer overflow (bsc#1193905).
• CVE-2021-4166: Fixed out-of-bounds read (bsc#1194093).
• CVE-2021-4192: Fixed use-after-free (bsc#1194217).
• CVE-2021-4193: Fixed out-of-bounds read (bsc#1194216).
• CVE-2022-0128: Fixed out-of-bounds read (bsc#1194388).
• CVE-2022-0213: Fixed heap-based buffer overflow (bsc#1194885).
• CVE-2022-0261: Fixed heap-based buffer overflow (bsc#1194872).
• CVE-2022-0318: Fixed heap-based buffer overflow (bsc#1195004).
• CVE-2022-0359: Fixed heap-based buffer overflow in init_ccline() in ex_getln.c (bsc#1195203).
• CVE-2022-0392: Fixed heap-based buffer overflow (bsc#1195332).
• CVE-2022-0407: Fixed heap-based buffer overflow (bsc#1195354).
• CVE-2022-0696: Fixed NULL pointer dereference (bsc#1196361).
• CVE-2022-1381: Fixed global heap buffer overflow in skip_range (bsc#1198596).
• CVE-2022-1420: Fixed out-of-range pointer offset (bsc#1198748).
• CVE-2022-1616: Fixed use-after-free in append_command (bsc#1199331).
• CVE-2022-1619: Fixed heap-based Buffer Overflow in function cmdline_erase_chars (bsc#1199333).
• CVE-2022-1620: Fixed NULL pointer dereference in function vim_regexec_string (bsc#1199334).
• CVE-2022-1733: Fixed heap-based buffer overflow in cindent.c (bsc#1199655).
• CVE-2022-1735: Fixed heap-based buffer overflow (bsc#1199651).
• CVE-2022-1771: Fixed stack exhaustion (bsc#1199693).
• CVE-2022-1785: Fixed out-of-bounds write (bsc#1199745).
• CVE-2022-1796: Fixed use-after-free in find_pattern_in_path (bsc#1199747).
• CVE-2022-1851: Fixed out-of-bounds read (bsc#1199936).
• CVE-2022-1897: Fixed out-of-bounds write (bsc#1200010).
• CVE-2022-1898: Fixed use-after-free (bsc#1200011).
• CVE-2022-1927: Fixed buffer over-read (bsc#1200012).

This update for vim fixes the following issues:

Updated to version 9.0.0814:

• Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
• Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
• Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
• Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
• Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
• Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
• Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
• Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
• Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
• Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
• Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
• Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
• Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
• Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
• Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
• Fixing bsc#1200884 Vim: Error on startup
• Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
• Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
• Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
• Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
• Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
• Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
• Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
• Fixing bsc#1201620 vim: SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
• Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
• Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
• Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
• Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
• Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
• Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
• Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
• Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
• Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
• Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
• Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
• Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
• Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
• Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
• Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
• Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
• Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
• Fixing bsc#1201154 VUL-1:…

It was discovered that Vim incorrectly handled memory access. An attacker could potentially use this issue to cause the program to crash, use unexpected values, or execute arbitrary code. (CVE-2022-1968)

It was discovered that Vim incorrectly handled memory access. An attacker could potentially use this issue to cause the corruption of sensitive information, a crash, or arbitrary code execution. (CVE-2022-1897, CVE-2022-1942)

It was discovered that Vim could be made to dereference invalid memory. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1725)

It was discovered that Vim could be made to recurse infinitely. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1771)

It was discovered that Vim could be made to write out of bounds with a put command. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-1886)

It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1897, CVE-2022-2000)

It was discovered that Vim did not properly manage memory in the spell command. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-2042)

It was discovered that Vim did not properly manage memory. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2023-46246, CVE-2023-48231)

It was discovered that Vim could be made to divide by zero. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 23.04 and Ubuntu 23.10. (CVE-2023-48232)

It was discovered that Vim contained multiple arithmetic overflows. An attacker could possibly use these issues to cause a denial of service. (CVE-2023-48233, CVE-2023-48234, CVE-2023-48235, CVE-2023-48236, CVE-2023-48237)

It was discovered that Vim did not properly manage memory in the substitute command. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-48706)