CVE-2022-1725

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.495.(CVE-2022-1725)

NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959.

• SECURITY UPDATE: Use After Free in vim
  • debian/patches/CVE-2022-3352.patch: Disallow deleting the current buffer to avoid using freed memory
  • CVE-2022-3352
• SECURITY UPDATE: Crash when matching buffer with invalid pattern
  • debian/patches/CVE-2022-1674.patch: Check for NULL regprog
  • CVE-2022-1674
• SECURITY UPDATE: Using NULL regexp program
  • debian/patches/CVE-2022-1725.patch: Check for regexp program becoming NULL in more places
  • CVE-2022-1725
• Fix: CI crashes when running out of memory, NULL pointer dereference
  • debian/patches/fix-addstate.patch: Apply 'maxmempattern' also to new regexp engine, check NULL pointers inside addstate() function

• CVE-2022-0158: fix Vim9 reading before start of line with single $
• CVE-2022-0696: fix crash when switching tabpage in cmdline window
• CVE-2022-1674: fix crash when matching buffer with invalid pattern
• CVE-2022-1725: fix using NULL regexp program in buffer matching
• CVE-2022-1771: fix recursive command line crash by limiting getcmdline depth
• CVE-2022-2208: fix crash when deleting buffers in diff mode
• CVE-2022-2598: fix invalid memory access in diff mode with dp and undo
• CVE-2022-2874: fix NULL pointer when skipping compiled Vim9 code
• CVE-2022-2923: fix crash with mkspell on empty dictionary file
• CVE-2022-2980: fix crash with mouse click when TabPageIdxs not initialized

• CVE-2022-0158: fix Vim9 reading before start of line with single $
• CVE-2022-0696: fix crash when switching tabpage in cmdline window
• CVE-2022-1674: fix crash when matching buffer with invalid pattern
• CVE-2022-1725: fix using NULL regexp program in buffer matching
• CVE-2022-1771: fix recursive command line crash by limiting getcmdline depth
• CVE-2022-2208: fix crash when deleting buffers in diff mode
• CVE-2022-2598: fix invalid memory access in diff mode with dp and undo
• CVE-2022-2874: fix NULL pointer when skipping compiled Vim9 code
• CVE-2022-2923: fix crash with mkspell on empty dictionary file
• CVE-2022-2980: fix crash with mouse click when TabPageIdxs not initialized

It was discovered that Vim could be made to crash when searching specially crafted patterns. An attacker could possibly use this to crash Vim and cause denial of service. (CVE-2022-1674)

It was discovered that there existed a NULL pointer dereference in Vim. An attacker could possibly use this to crash Vim and cause denial of service. (CVE-2022-1725)

It was discovered that there existed a buffer over-read in Vim when searching specially crafted patterns. An attacker could possibly use this to crash Vim and cause denial of service. (CVE-2022-2124)

It was discovered that there existed a heap buffer overflow in Vim when auto-indenting lisp. An attacker could possibly use this to crash Vim and cause denial of service. (CVE-2022-2125)

It was discovered that there existed an out of bounds read in Vim when performing spelling suggestions. An attacker could possibly use this to crash Vim and cause denial of service. (CVE-2022-2126)

It was discovered that Vim accessed invalid memory when executing specially crafted command line expressions. An attacker could possibly use this to crash Vim, access or modify memory, or execute arbitrary commands. (CVE-2022-2175)

It was discovered that there existed an out-of-bounds read in Vim when auto-indenting lisp. An attacker could possibly use this to crash Vim, access or modify memory, or execute arbitrary commands. (CVE-2022-2183)

It was discovered that Vim accessed invalid memory when terminal size changed. An attacker could possibly use this to crash Vim, access or modify memory, or execute arbitrary commands. (CVE-2022-2206)

It was discovered that there existed a stack buffer overflow in Vim's spelldump. An attacker could possibly use this to crash Vim and cause denial of service. (CVE-2022-2304)

It was discovered that Vim could be made to dereference invalid memory. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1725)

It was discovered that Vim could be made to recurse infinitely. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1771)

It was discovered that Vim could be made to write out of bounds with a put command. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-1886)

It was discovered that Vim could be made to write out of bounds. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-1897, CVE-2022-2000)

It was discovered that Vim did not properly manage memory in the spell command. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-2042)

It was discovered that Vim did not properly manage memory. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2023-46246, CVE-2023-48231)

It was discovered that Vim could be made to divide by zero. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 23.04 and Ubuntu 23.10. (CVE-2023-48232)

It was discovered that Vim contained multiple arithmetic overflows. An attacker could possibly use these issues to cause a denial of service. (CVE-2023-48233, CVE-2023-48234, CVE-2023-48235, CVE-2023-48236, CVE-2023-48237)

It was discovered that Vim did not properly manage memory in the substitute command. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10. (CVE-2023-48706)