{"id":"CVE-2022-0417","aliases":["ALPINE-CVE-2022-0417","AZL-8461","BELL-CVE-2022-0417","CLSA-2022-1645465475","CLSA-2022-1645465659","CLSA-2022-1645466182","DEBIAN-CVE-2022-0417","DLA-3053-1","DLA-3182-1","DLA-4097-1","EUVD-2022-15559","GHSA-cj93-q2w3-fjxc","MGASA-2022-0203","OESA-2022-1514","UBUNTU-CVE-2022-0417","USN-5801-1","openSUSE-SU-2024:11812-1"],"status":"published","title":"Heap-based Buffer Overflow in vim/vim","description":"Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.","severity":{"version":"3.0","score":8.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01534,"percentile":0.74995,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122","CWE-787"],"published":"2022-02-01T00:00:00Z","modified":"2026-11-03T08:00:54Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"vim","fixed_in":["8.2.4619-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"vim","fixed_in":["8.2.4619-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"vim","fixed_in":["8.2.4619-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"vim","fixed_in":["8.2.4619-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"vim","fixed_in":["8.2.4350-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"vim","fixed_in":["8.2.4350-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"vim","fixed_in":["8.2.4350-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"vim","fixed_in":["8.2.4350-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"vim","fixed_in":["8.2.4350-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"vim","fixed_in":["8.2.4350-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"vim","fixed_in":["8.2.4350-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"vim","fixed_in":["8.2.4350-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"vim","fixed_in":["8.2.4350-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"vim","fixed_in":["8.2.4743-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"vim","fixed_in":["2:8.2.4659-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vim","fixed_in":["2:8.2.4659-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vim","fixed_in":["2:8.2.4659-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"vim","fixed_in":["2:8.1.2269-1ubuntu5.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"vim","fixed_in":["2:8.2.3995-1ubuntu2.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.4619-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.4619-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.4619-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.4619-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.4350-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.4350-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.4350-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.4350-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.4350-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.4350-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.4350-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.4350-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.4350-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.4743-1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-athena","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-athena-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gnome-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk3-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gui-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-nox-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-tiny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els8"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.4659-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.4659-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.4659-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.0197-4+deb9u7"}]}],"versions":["2:8.0.0197-4","2:8.0.0197-4+deb9u1","2:8.0.0197-4+deb9u2","2:8.0.0197-4+deb9u3","2:8.0.0197-4+deb9u4","2:8.0.0197-4+deb9u5","2:8.0.0197-4+deb9u6"],"bundled":9},{"source":"osv","ecosystem":"Debian:10","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u3"}]}],"versions":["2:8.1.0875-5","2:8.1.0875-5+deb10u1","2:8.1.0875-5+deb10u2"],"bundled":41},{"source":"osv","ecosystem":"Debian:11","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2434-3+deb11u2"}]}],"versions":["2:8.2.2434-3","2:8.2.2434-3+deb11u1"],"bundled":32},{"source":"osv","ecosystem":"Mageia:8","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.4975-1.mga8"}]}],"bundled":31},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2-16.oe1"}]}],"bundled":12},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2-16.oe1"}]}],"bundled":12},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2-16.oe1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.2269-1ubuntu5.11"}]}],"versions":["2:8.1.0875-5ubuntu2","2:8.1.0875-5ubuntu3","2:8.1.0875-5ubuntu4","2:8.1.2269-1ubuntu1","2:8.1.2269-1ubuntu4","2:8.1.2269-1ubuntu5","2:8.1.2269-1ubuntu5.3","2:8.1.2269-1ubuntu5.4","2:8.1.2269-1ubuntu5.6","2:8.1.2269-1ubuntu5.7","2:8.1.2269-1ubuntu5.8","2:8.1.2269-1ubuntu5.9"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.3995-1ubuntu2.3"}]}],"versions":["2:8.2.2434-3ubuntu3","2:8.2.2434-3ubuntu4","2:8.2.3565-1ubuntu1","2:8.2.3565-1ubuntu2","2:8.2.3565-1ubuntu3","2:8.2.3565-1ubuntu5","2:8.2.3995-1ubuntu1","2:8.2.3995-1ubuntu2","2:8.2.3995-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.10"}]}],"versions":["2:8.0.0197-4ubuntu5","2:8.0.1144-1ubuntu1","2:8.0.1401-1ubuntu1","2:8.0.1401-1ubuntu2","2:8.0.1401-1ubuntu3","2:8.0.1453-1ubuntu1","2:8.0.1453-1ubuntu1.1","2:8.0.1453-1ubuntu1.3","2:8.0.1453-1ubuntu1.4","2:8.0.1453-1ubuntu1.6","2:8.0.1453-1ubuntu1.7","2:8.0.1453-1ubuntu1.8","2:8.0.1453-1ubuntu1.9"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.2269-1ubuntu5.11"}]}],"versions":["2:8.1.0875-5ubuntu2","2:8.1.0875-5ubuntu3","2:8.1.0875-5ubuntu4","2:8.1.2269-1ubuntu1","2:8.1.2269-1ubuntu4","2:8.1.2269-1ubuntu5","2:8.1.2269-1ubuntu5.3","2:8.1.2269-1ubuntu5.4","2:8.1.2269-1ubuntu5.6","2:8.1.2269-1ubuntu5.7","2:8.1.2269-1ubuntu5.8","2:8.1.2269-1ubuntu5.9"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.3995-1ubuntu2.3"}]}],"versions":["2:8.2.2434-3ubuntu3","2:8.2.2434-3ubuntu4","2:8.2.3565-1ubuntu1","2:8.2.3565-1ubuntu2","2:8.2.3565-1ubuntu3","2:8.2.3565-1ubuntu5","2:8.2.3995-1ubuntu1","2:8.2.3995-1ubuntu2","2:8.2.3995-1ubuntu2.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.4286-1.1"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"vim","product":"vim"},{"vendor":"vim","product":"vim/vim"}],"references":[{"url":"https://huntr.dev/bounties/fc86bc8d-c866-4ade-8b7f-e49cec306d1a","tags":["x_transferred","Exploit","Patch","Third Party Advisory","web"]},{"url":"https://github.com/vim/vim/commit/652dee448618589de5528a9e9a36995803f5557a","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFXFAILMLUIK4MBUEZO4HNBNKYZRJ5AP/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/06/msg00014.html","tags":["mailing-list","x_transferred","Mitigation","Third Party Advisory","article"]},{"url":"https://security.gentoo.org/glsa/202208-32","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0417","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFXFAILMLUIK4MBUEZO4HNBNKYZRJ5AP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UFXFAILMLUIK4MBUEZO4HNBNKYZRJ5AP"},{"url":"https://github.com/advisories/GHSA-cj93-q2w3-fjxc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-0417","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-0417","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2022-1645465475","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2022-1645465659.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2022-1645466182.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0417.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-0417","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0203.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29972","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/7JBXG3MU6EZWJGJD6UTHHONHGJBYPQQT/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/UCWG5L6CRQWACGVP7CYGESUB3G6QJ3GS/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/UFXFAILMLUIK4MBUEZO4HNBNKYZRJ5AP/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4GOY5YWTP5QUY2EFLCL7AUWA2CV57C37/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/UURGABNDL77YR5FRQKTFBYNBDQX2KO7Q/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/HBUYQBZ6GWAWJRWP7AODJ4KHW5BCKDVP/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FDNZ3N5S7UGKPUUKPGOQQGPJJK3YTW37/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/C3R36VSLO4TRX72SWB6IDJOD24BQXPX2/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/C2CQXRLBIC4S7JQVEIN5QXKQPYWB5E3J/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/X6E457NYOIRWBJHKB7ON44UY5AVTG4HU/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/A6BY5P7ERZS7KXSBCGFCOXLMLGWUUJIH/","tags":["web"]},{"url":"https://www.debian.org/lts/security/2022/dla-3011","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2083924","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/HIP7KG7TVS5YF3QREAY2GOGUT3YUBZAI/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ODXVYZC5Z4XRRZK7CK6B6IURYVYHA25U/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/QKIX5HYKWXWG6QBCPPTPQ53GNOFHSAIS/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/IUPOLEX5GXC733HL4EFYMHFU7NISJJZG/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1514","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0261","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0318","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0351","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0359","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0361","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0368","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0392","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0413","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0443","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0213","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-0417","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5801-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0417","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-0392","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0443","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-0417","title":"Heap-based Buffer Overflow in vim/vim","description":"Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.","status":"published","published":"2022-02-01T00:00:00Z","modified":"2025-11-03T20:34:28.705Z","cvss":[{"version":"3.0","score":8.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:34:41.34666Z"}],"euvd":[{"id":"EUVD-2022-15559","description":"Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.","status":"published","published":"2022-02-01T00:00:00Z","modified":"2025-11-03T20:34:28Z","cvss":[{"version":"3.0","score":8.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:32.503916Z"}],"ghsa":[{"id":"GHSA-cj93-q2w3-fjxc","title":"Heap-based Buffer Overflow in Conda vim prior to 8.2.","description":"Heap-based Buffer Overflow in Conda vim prior to 8.2.","status":"published","published":"2022-02-12T00:01:19Z","modified":"2025-11-03T21:31:41Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122","CWE-787"],"updated_at":"2026-11-02T15:04:19.274788Z"}],"nvd":[{"id":"CVE-2022-0417","description":"Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.","status":"published","published":"2022-02-01T13:15:10.07Z","modified":"2026-06-17T04:20:33.82Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":8.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-122","CWE-787"],"updated_at":"2026-11-02T14:07:11.52734Z"}],"osv":[{"id":"ALPINE-CVE-2022-0417","description":"Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.","status":"published","published":"2022-02-01T13:15:10.07Z","modified":"2026-11-03T07:30:04.489605587Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"AZL-8461","title":"CVE-2022-0417 affecting package vim for versions less than 8.2.4743-1","description":"Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.","status":"published","published":"2022-02-01T13:15:10Z","modified":"2026-04-21T04:34:51.079235Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:10.335477Z"},{"id":"BELL-CVE-2022-0417","title":"CVE-2022-0417 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:23.83312Z","modified":"2026-01-26T09:47:55.784256Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2022-0417","title":"Heap-based Buffer Overflow in vim/vim","description":"Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.","status":"published","published":"2022-02-01T00:00:00Z","modified":"2026-10-28T10:28:18.701996921Z","cvss":[{"version":"3.0","score":8.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:44:22.824781Z"},{"id":"DEBIAN-CVE-2022-0417","description":"Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.","status":"published","published":"2022-02-01T13:15:10.07Z","modified":"2026-11-03T08:00:54.417565489Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"OESA-2022-1514","title":"vim security update","description":"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor \u0026apos;Vi\u0026apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.\r\n\r\n\r\n\r\nSecurity Fix(es):\r\n\r\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.(CVE-2022-0261)\r\n\r\nHeap-based Buffer Overflow in vim/vim prior to 8.2.(CVE-2022-0318)\r\n\r\nAccess of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.(CVE-2022-0351)\r\n\r\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.(CVE-2022-0359)\r\n\r\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.(CVE-2022-0361)\r\n\r\nOut-of-bounds Read in GitHub repository vim/vim prior to 8.2.(CVE-2022-0368)\r\n\r\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.(CVE-2022-0392)\r\n\r\nUse After Free in GitHub repository vim/vim prior to 8.2.(CVE-2022-0413)\r\n\r\nStack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.(CVE-2022-0408)\r\n\r\nUse After Free in Conda vim prior to 8.2.(CVE-2022-0443)\r\n\r\nHeap-based Buffer Overflow in Conda vim prior to 8.2.(CVE-2022-0417)\n\nvim is vulnerable to Heap-based Buffer Overflow(CVE-2022-0213)","status":"published","published":"2022-02-11T11:04:47Z","modified":"2026-08-18T01:16:22.833578821Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-0417","description":"Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.","status":"published","published":"2022-02-01T13:15:00Z","modified":"2026-02-04T02:33:22.769131Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":8.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"CLSA-2022-1645465475","title":"Fix CVE(s): CVE-2022-0408, CVE-2022-0417, CVE-2022-0443, CVE-2022-0413","description":"\n   * SECURITY UPDATE: Stack corruption when looking for spell suggestions\n     - debian/patches/CVE-2022-0408.patch: Prevent the depth increased too\n       much, add a five second time limit to finding suggestions\n     - CVE-2022-0408\n   * SECURITY UPDATE: Using freed memory when substitute with function call\n     - debian/patches/CVE-2022-0413.patch: Make a copy of the substituted\n       text\n     - CVE-2022-0413\n   * SECURITY UPDATE: ':retab 0' may cause illegal memory access\n     - debian/patches/CVE-2022-0417.patch: Limit the value of 'tabstop'\n       to 10000\n     - CVE-2022-0417\n   * SECURITY UPDATE: Using freed memory with ':lopen' and ':bwipe'\n     - debian/patches/CVE-2022-0443.patch: Do not use a wiped out buffer\n     - CVE-2022-0443","status":"published","published":"2022-02-21T17:44:35Z","modified":"2026-06-04T10:03:55.286819105Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2022-1645465659","title":"Fixed CVEs in vim: CVE-2022-0408, CVE-2022-0413, CVE-2022-0417, CVE-2022-0443","description":"- CVE-2022-0408: fix stack corruption when looking for spell suggestions\n- CVE-2022-0413: fix using freed memory when substitute with function call\n- CVE-2022-0417: fix illegal memory access caused by ':retab 0'\n- CVE-2022-0443: fix using freed memory with ':lopen' and ':bwipe'","status":"published","published":"2022-02-21T17:47:39Z","modified":"2026-06-01T00:33:24.485939877Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2022-1645466182","title":"Fix of CVE: CVE-2022-0413, CVE-2022-0417, CVE-2022-0408, CVE-2022-0443","description":"- CVE-2022-0408: fix stack corruption when looking for spell suggestions\n- CVE-2022-0413: fix using freed memory when substitute with function call\n- CVE-2022-0417: fix illegal memory access caused by ':retab 0'\n- CVE-2022-0443: fix using freed memory with ':lopen' and ':bwipe'","status":"published","published":"2022-02-21T17:56:22Z","modified":"2026-10-21T10:46:02.669845619Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"DLA-3053-1","title":"vim - security update","status":"published","published":"2022-06-20T00:00:00Z","modified":"2026-03-09T01:19:12.686767Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3182-1","title":"vim - security update","status":"published","published":"2022-11-08T00:00:00Z","modified":"2026-03-09T01:23:17.897521Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-4097-1","title":"vim - security update","status":"published","published":"2025-03-30T00:00:00Z","modified":"2026-03-09T01:23:09.546419Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2022-0203","title":"Updated vim packages fix security vulnerability","description":"vim is vulnerable to out of bounds read (CVE-2022-0213)\nHeap-based Buffer Overflow in block_insert() in src/ops.c (CVE-2022-0261)\na heap-based OOB read of size 1 (CVE-2022-0128)\nheap-based buffer overflow in utf_head_off() in mbyte.c (CVE-2022-0318)\naccess of memory location before start of buffer (CVE-2022-0351)\nheap-based buffer overflow in init_ccline() in ex_getln.c (CVE-2022-0359)\nStack-based Buffer Overflow in spellsuggest.c (CVE-2022-0408)\nuse after free in src/ex_cmds.c (CVE-2022-0413)\nout-of-bounds read in delete_buff_tail() in getchar.c (CVE-2022-0393)\nheap-based-buffer-overflow in ex_retab() of src/indent.c (CVE-2022-0417)\nheap-use-after-free in enter_buffer() of src/buffer.c (CVE-2022-0443)\nheap overflow in ex_retab() may lead to crash (CVE-2022-0572)\nStack-based Buffer Overflow in vim prior to 8.2. (CVE-2022-0629)\nNULL Pointer Dereference in vim prior to 8.2 (CVE-2022-0696)\nbuffer overflow (CVE-2022-0714)\nUse of Out-of-range Pointer Offset (CVE-2022-0729)\nUse of Out-of-range Pointer Offset in vim (CVE-2022-0685)\nUse of Out-of-range Pointer Offset in vim (CVE-2022-0554)\nHeap-based Buffer Overflow occurs in vim (CVE-2022-0943)\nheap buffer overflow in get_one_sourceline (CVE-2022-1160)\nuse after free in utf_ptr2char (CVE-2022-1154)\nglobal heap buffer overflow in skip_range (CVE-2022-1381)\nOut-of-range Pointer Offset (CVE-2022-1420)\nheap-buffer-overflow in append_command of src/ex_docmd.c (CVE-2022-1616)\nheap-buffer-overflow in cmdline_erase_chars of ex_getln.c (CVE-2022-1619)\nNULL Pointer Dereference in vim_regexec_string() of regexp.c (CVE-2022-1620)\nheap buffer overflow (CVE-2022-1621)\nbuffer over-read (CVE-2022-1629)\nNULL pointer dereference in vim_regexec_string() of regexp.c (CVE-2022-1674)\na buffer over-read found in scriptfile.c (CVE-2022-1769)\nHeap-based Buffer Overflow in cindent.c (CVE-2022-1733)\n","status":"published","published":"2022-05-25T18:46:18Z","modified":"2026-04-16T04:40:48.788777154Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:11812-1","title":"gvim-8.2.4286-1.1 on GA media","description":"These are all security issues fixed in the gvim-8.2.4286-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:36:36.154668Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"USN-5801-1","title":"vim vulnerabilities","description":"It was discovered that Vim makes illegal memory calls when pasting\nbrackets in Ex mode. An attacker could possibly use this to crash Vim,\naccess or modify memory, or execute arbitrary commands. This issue\naffected only Ubuntu 20.04 and 22.04 (CVE-2022-0392)\n\nIt was discovered that Vim makes illegal memory calls when making\ncertain retab calls. An attacker could possibly use this to crash Vim,\naccess or modify memory, or execute arbitrary commands. (CVE-2022-0417)\n","status":"published","published":"2023-01-12T21:31:55Z","modified":"2026-02-10T04:42:55Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}