{"id":"CVE-2024-22667","aliases":["AZL-34281","BELL-CVE-2024-22667","CLSA-2024-1709563938","CLSA-2024-1709564274","CLSA-2024-1710436524","CLSA-2024-1720776957","CLSA-2026-1787304699","DEBIAN-CVE-2024-22667","DLA-4097-1","EUVD-2024-20200","GHSA-jhwv-44fv-jwp5","MGASA-2024-0040","ROOT-OS-ALPINE-318-CVE-2024-22667","SUSE-SU-2024:0783-1","SUSE-SU-2024:0871-1","SUSE-SU-2024:1287-1","UBUNTU-CVE-2024-22667","USN-6698-1"],"status":"published","title":"Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls...","description":"Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00563,"percentile":0.47147,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2024-02-05T00:00:00Z","modified":"2026-11-02T12:00:47Z","fixes":[{"ecosystem":"Azure Linux:2","package":"vim","fixed_in":["9.0.2121-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"vim","fixed_in":["9.1.0936-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"vim","fixed_in":["9.1.0-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"vim-X11","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els46"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"vim-common","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els46"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"vim-enhanced","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els46"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"vim-filesystem","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els46"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"vim-minimal","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els46"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"vim-X11","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els46"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"vim-common","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els46"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"vim-enhanced","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els46"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"vim-filesystem","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els46"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"vim-minimal","fixed_in":["3:7.4.629-5.2.el6.tuxcare.els46"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-athena","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-athena-py2","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-common","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-doc","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gnome","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gnome-py2","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk-py2","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk3","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk3-py2","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gui-common","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-nox","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-nox-py2","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-runtime","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els50"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-tiny","fixed_in":["3:7.4.1689-3ubuntu1.5+tuxcare.els50"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"vim","fixed_in":["2:9.0.1378-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vim","fixed_in":["2:9.0.2189-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vim","fixed_in":["2:9.0.2189-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"vim","fixed_in":["9.1.111-1.mga9"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.18","package":"vim","fixed_in":["9.0.2073-r00071","9.0.2073-r00072","9.0.2073-r00075","9.0.2073-r00074","9.0.2073-r00073","9.0.2073-r00076"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.18","package":"rootio-vim","fixed_in":["9.0.2073-r00071","9.0.2073-r00072","9.0.2073-r00075","9.0.2073-r00074","9.0.2073-r00073","9.0.2073-r00076"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vim","fixed_in":["2:7.4.052-1ubuntu3.1+esm16"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vim","fixed_in":["2:7.4.1689-3ubuntu1.5+esm23"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vim","fixed_in":["2:8.0.1453-1ubuntu1.13+esm8"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"vim","fixed_in":["2:8.1.2269-1ubuntu5.22"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"vim","fixed_in":["2:8.2.3995-1ubuntu2.16"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2121-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0820-r2"},{"fixed":"9.1.0936-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.1395-r0"},{"fixed":"9.1.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els46"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els46"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els46"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els46"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els46"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els46"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els46"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els46"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els46"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els46"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-athena","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-athena-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gnome-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk3-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gui-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-nox-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-tiny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els50"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.el7_9.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.el7_9.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.el7_9.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.el7_9.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.el7_9.tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-athena","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-gui-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-tiny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"xxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"bundled":10},{"source":"osv","ecosystem":"Debian:12","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.0.1378-2+deb12u1"}]}],"versions":["2:9.0.1378-2"]},{"source":"osv","ecosystem":"Debian:13","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.0.2189-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.0.2189-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2434-3+deb11u2"}]}],"versions":["2:8.2.2434-3","2:8.2.2434-3+deb11u1"],"bundled":32},{"source":"osv","ecosystem":"Mageia:9","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.111-1.mga9"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.18","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2073-r00071"},{"fixed":"9.0.2073-r00072"},{"fixed":"9.0.2073-r00075"},{"fixed":"9.0.2073-r00074"},{"fixed":"9.0.2073-r00073"},{"fixed":"9.0.2073-r00076"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.18","package":"rootio-vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2073-r00071"},{"fixed":"9.0.2073-r00072"},{"fixed":"9.0.2073-r00075"},{"fixed":"9.0.2073-r00074"},{"fixed":"9.0.2073-r00073"},{"fixed":"9.0.2073-r00076"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-17.29.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-17.29.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150000.5.60.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150000.5.60.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150000.5.60.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150000.5.60.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150000.5.60.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150000.5.60.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150000.5.60.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150000.5.60.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150000.5.60.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150000.5.60.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150000.5.60.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150000.5.60.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150000.5.60.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150000.5.60.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150000.5.60.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150000.5.60.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150000.5.60.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150000.5.60.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150000.5.60.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150500.20.9.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150500.20.9.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150500.20.9.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0111-150500.20.9.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.052-1ubuntu3.1+esm16"}]}],"versions":["2:7.4.000-1ubuntu2","2:7.4.052-1ubuntu1","2:7.4.052-1ubuntu2","2:7.4.052-1ubuntu3","2:7.4.052-1ubuntu3.1","2:7.4.052-1ubuntu3.1+esm1","2:7.4.052-1ubuntu3.1+esm3","2:7.4.052-1ubuntu3.1+esm4","2:7.4.052-1ubuntu3.1+esm5","2:7.4.052-1ubuntu3.1+esm6","2:7.4.052-1ubuntu3.1+esm7","2:7.4.052-1ubuntu3.1+esm8","2:7.4.052-1ubuntu3.1+esm9","2:7.4.052-1ubuntu3.1+esm10","2:7.4.052-1ubuntu3.1+esm11","2:7.4.052-1ubuntu3.1+esm12","2:7.4.052-1ubuntu3.1+esm13","2:7.4.052-1ubuntu3.1+esm14","2:7.4.052-1ubuntu3.1+esm15"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.1689-3ubuntu1.5+esm23"}]}],"versions":["2:7.4.712-2ubuntu4","2:7.4.826-1ubuntu1","2:7.4.826-1ubuntu2","2:7.4.826-1ubuntu3","2:7.4.963-1ubuntu1","2:7.4.963-1ubuntu4","2:7.4.963-1ubuntu5","2:7.4.1689-3ubuntu1","2:7.4.1689-3ubuntu1.1","2:7.4.1689-3ubuntu1.2","2:7.4.1689-3ubuntu1.3","2:7.4.1689-3ubuntu1.4","2:7.4.1689-3ubuntu1.5","2:7.4.1689-3ubuntu1.5+esm2","2:7.4.1689-3ubuntu1.5+esm3","2:7.4.1689-3ubuntu1.5+esm4","2:7.4.1689-3ubuntu1.5+esm5","2:7.4.1689-3ubuntu1.5+esm6","2:7.4.1689-3ubuntu1.5+esm7","2:7.4.1689-3ubuntu1.5+esm8","2:7.4.1689-3ubuntu1.5+esm10","2:7.4.1689-3ubuntu1.5+esm11","2:7.4.1689-3ubuntu1.5+esm12","2:7.4.1689-3ubuntu1.5+esm13","2:7.4.1689-3ubuntu1.5+esm14","2:7.4.1689-3ubuntu1.5+esm15","2:7.4.1689-3ubuntu1.5+esm17","2:7.4.1689-3ubuntu1.5+esm18","2:7.4.1689-3ubuntu1.5+esm19","2:7.4.1689-3ubuntu1.5+esm20","2:7.4.1689-3ubuntu1.5+esm22"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+esm8"}]}],"versions":["2:8.0.0197-4ubuntu5","2:8.0.1144-1ubuntu1","2:8.0.1401-1ubuntu1","2:8.0.1401-1ubuntu2","2:8.0.1401-1ubuntu3","2:8.0.1453-1ubuntu1","2:8.0.1453-1ubuntu1.1","2:8.0.1453-1ubuntu1.3","2:8.0.1453-1ubuntu1.4","2:8.0.1453-1ubuntu1.6","2:8.0.1453-1ubuntu1.7","2:8.0.1453-1ubuntu1.8","2:8.0.1453-1ubuntu1.9","2:8.0.1453-1ubuntu1.10","2:8.0.1453-1ubuntu1.11","2:8.0.1453-1ubuntu1.12","2:8.0.1453-1ubuntu1.13","2:8.0.1453-1ubuntu1.13+esm1","2:8.0.1453-1ubuntu1.13+esm3","2:8.0.1453-1ubuntu1.13+esm4","2:8.0.1453-1ubuntu1.13+esm5","2:8.0.1453-1ubuntu1.13+esm6","2:8.0.1453-1ubuntu1.13+esm7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.2269-1ubuntu5.22"}]}],"versions":["2:8.1.0875-5ubuntu2","2:8.1.0875-5ubuntu3","2:8.1.0875-5ubuntu4","2:8.1.2269-1ubuntu1","2:8.1.2269-1ubuntu4","2:8.1.2269-1ubuntu5","2:8.1.2269-1ubuntu5.3","2:8.1.2269-1ubuntu5.4","2:8.1.2269-1ubuntu5.6","2:8.1.2269-1ubuntu5.7","2:8.1.2269-1ubuntu5.8","2:8.1.2269-1ubuntu5.9","2:8.1.2269-1ubuntu5.11","2:8.1.2269-1ubuntu5.12","2:8.1.2269-1ubuntu5.13","2:8.1.2269-1ubuntu5.14","2:8.1.2269-1ubuntu5.15","2:8.1.2269-1ubuntu5.16","2:8.1.2269-1ubuntu5.17","2:8.1.2269-1ubuntu5.18","2:8.1.2269-1ubuntu5.20","2:8.1.2269-1ubuntu5.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.3995-1ubuntu2.16"}]}],"versions":["2:8.2.2434-3ubuntu3","2:8.2.2434-3ubuntu4","2:8.2.3565-1ubuntu1","2:8.2.3565-1ubuntu2","2:8.2.3565-1ubuntu3","2:8.2.3565-1ubuntu5","2:8.2.3995-1ubuntu1","2:8.2.3995-1ubuntu2","2:8.2.3995-1ubuntu2.1","2:8.2.3995-1ubuntu2.3","2:8.2.3995-1ubuntu2.4","2:8.2.3995-1ubuntu2.5","2:8.2.3995-1ubuntu2.7","2:8.2.3995-1ubuntu2.8","2:8.2.3995-1ubuntu2.9","2:8.2.3995-1ubuntu2.10","2:8.2.3995-1ubuntu2.11","2:8.2.3995-1ubuntu2.12","2:8.2.3995-1ubuntu2.13","2:8.2.3995-1ubuntu2.15"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.052-1ubuntu3.1+esm16"}]}],"versions":["2:7.4.000-1ubuntu2","2:7.4.052-1ubuntu1","2:7.4.052-1ubuntu2","2:7.4.052-1ubuntu3","2:7.4.052-1ubuntu3.1","2:7.4.052-1ubuntu3.1+esm1","2:7.4.052-1ubuntu3.1+esm3","2:7.4.052-1ubuntu3.1+esm4","2:7.4.052-1ubuntu3.1+esm5","2:7.4.052-1ubuntu3.1+esm6","2:7.4.052-1ubuntu3.1+esm7","2:7.4.052-1ubuntu3.1+esm8","2:7.4.052-1ubuntu3.1+esm9","2:7.4.052-1ubuntu3.1+esm10","2:7.4.052-1ubuntu3.1+esm11","2:7.4.052-1ubuntu3.1+esm12","2:7.4.052-1ubuntu3.1+esm13","2:7.4.052-1ubuntu3.1+esm14","2:7.4.052-1ubuntu3.1+esm15"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.1689-3ubuntu1.5+esm23"}]}],"versions":["2:7.4.712-2ubuntu4","2:7.4.826-1ubuntu1","2:7.4.826-1ubuntu2","2:7.4.826-1ubuntu3","2:7.4.963-1ubuntu1","2:7.4.963-1ubuntu4","2:7.4.963-1ubuntu5","2:7.4.1689-3ubuntu1","2:7.4.1689-3ubuntu1.1","2:7.4.1689-3ubuntu1.2","2:7.4.1689-3ubuntu1.3","2:7.4.1689-3ubuntu1.4","2:7.4.1689-3ubuntu1.5","2:7.4.1689-3ubuntu1.5+esm2","2:7.4.1689-3ubuntu1.5+esm3","2:7.4.1689-3ubuntu1.5+esm4","2:7.4.1689-3ubuntu1.5+esm5","2:7.4.1689-3ubuntu1.5+esm6","2:7.4.1689-3ubuntu1.5+esm7","2:7.4.1689-3ubuntu1.5+esm8","2:7.4.1689-3ubuntu1.5+esm10","2:7.4.1689-3ubuntu1.5+esm11","2:7.4.1689-3ubuntu1.5+esm12","2:7.4.1689-3ubuntu1.5+esm13","2:7.4.1689-3ubuntu1.5+esm14","2:7.4.1689-3ubuntu1.5+esm15","2:7.4.1689-3ubuntu1.5+esm17","2:7.4.1689-3ubuntu1.5+esm18","2:7.4.1689-3ubuntu1.5+esm19","2:7.4.1689-3ubuntu1.5+esm20","2:7.4.1689-3ubuntu1.5+esm22"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+esm8"}]}],"versions":["2:8.0.0197-4ubuntu5","2:8.0.1144-1ubuntu1","2:8.0.1401-1ubuntu1","2:8.0.1401-1ubuntu2","2:8.0.1401-1ubuntu3","2:8.0.1453-1ubuntu1","2:8.0.1453-1ubuntu1.1","2:8.0.1453-1ubuntu1.3","2:8.0.1453-1ubuntu1.4","2:8.0.1453-1ubuntu1.6","2:8.0.1453-1ubuntu1.7","2:8.0.1453-1ubuntu1.8","2:8.0.1453-1ubuntu1.9","2:8.0.1453-1ubuntu1.10","2:8.0.1453-1ubuntu1.11","2:8.0.1453-1ubuntu1.12","2:8.0.1453-1ubuntu1.13","2:8.0.1453-1ubuntu1.13+esm1","2:8.0.1453-1ubuntu1.13+esm3","2:8.0.1453-1ubuntu1.13+esm4","2:8.0.1453-1ubuntu1.13+esm5","2:8.0.1453-1ubuntu1.13+esm6","2:8.0.1453-1ubuntu1.13+esm7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.2269-1ubuntu5.22"}]}],"versions":["2:8.1.0875-5ubuntu2","2:8.1.0875-5ubuntu3","2:8.1.0875-5ubuntu4","2:8.1.2269-1ubuntu1","2:8.1.2269-1ubuntu4","2:8.1.2269-1ubuntu5","2:8.1.2269-1ubuntu5.3","2:8.1.2269-1ubuntu5.4","2:8.1.2269-1ubuntu5.6","2:8.1.2269-1ubuntu5.7","2:8.1.2269-1ubuntu5.8","2:8.1.2269-1ubuntu5.9","2:8.1.2269-1ubuntu5.11","2:8.1.2269-1ubuntu5.12","2:8.1.2269-1ubuntu5.13","2:8.1.2269-1ubuntu5.14","2:8.1.2269-1ubuntu5.15","2:8.1.2269-1ubuntu5.16","2:8.1.2269-1ubuntu5.17","2:8.1.2269-1ubuntu5.18","2:8.1.2269-1ubuntu5.20","2:8.1.2269-1ubuntu5.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.3995-1ubuntu2.16"}]}],"versions":["2:8.2.2434-3ubuntu3","2:8.2.2434-3ubuntu4","2:8.2.3565-1ubuntu1","2:8.2.3565-1ubuntu2","2:8.2.3565-1ubuntu3","2:8.2.3565-1ubuntu5","2:8.2.3995-1ubuntu1","2:8.2.3995-1ubuntu2","2:8.2.3995-1ubuntu2.1","2:8.2.3995-1ubuntu2.3","2:8.2.3995-1ubuntu2.4","2:8.2.3995-1ubuntu2.5","2:8.2.3995-1ubuntu2.7","2:8.2.3995-1ubuntu2.8","2:8.2.3995-1ubuntu2.9","2:8.2.3995-1ubuntu2.10","2:8.2.3995-1ubuntu2.11","2:8.2.3995-1ubuntu2.12","2:8.2.3995-1ubuntu2.13","2:8.2.3995-1ubuntu2.15"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"vim","product":"vim"}],"references":[{"url":"https://github.com/vim/vim/commit/b39b240c386a5a29241415541f1c99e2e6b8ce47","tags":["x_transferred","Patch","fix"]},{"url":"https://gist.githubusercontent.com/henices/2467e7f22dcc2aa97a2453e197b55a0c/raw/7b54bccc9a129c604fb139266f4497ab7aaa94c7/gistfile1.txt","tags":["x_transferred","Exploit","Third Party Advisory","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UI44Y4LJLG34D4HNB6NTPLUPZREHAEL7/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UIQLVUSYHDN3644K6EFDI7PRZOTIKXM3/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240223-0008/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIQLVUSYHDN3644K6EFDI7PRZOTIKXM3/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UI44Y4LJLG34D4HNB6NTPLUPZREHAEL7/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22667","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UI44Y4LJLG34D4HNB6NTPLUPZREHAEL7"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UIQLVUSYHDN3644K6EFDI7PRZOTIKXM3"},{"url":"https://security.netapp.com/advisory/ntap-20240223-0008"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIQLVUSYHDN3644K6EFDI7PRZOTIKXM3"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UI44Y4LJLG34D4HNB6NTPLUPZREHAEL7"},{"url":"https://github.com/advisories/GHSA-jhwv-44fv-jwp5"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-22667","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2024-1709563938.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2024-1709564274.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2024-1710436524.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/centos7-els/CLSA-2024-1720776957.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787304699.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25749","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26269","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28417","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28421","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33412","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34982","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35177","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41411","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22667.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-22667","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0040.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32850","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240783-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215005","tags":["report"]},{"url":"https://bugzilla.suse.com/1217316","tags":["report"]},{"url":"https://bugzilla.suse.com/1217320","tags":["report"]},{"url":"https://bugzilla.suse.com/1217321","tags":["report"]},{"url":"https://bugzilla.suse.com/1217324","tags":["report"]},{"url":"https://bugzilla.suse.com/1217326","tags":["report"]},{"url":"https://bugzilla.suse.com/1217329","tags":["report"]},{"url":"https://bugzilla.suse.com/1217330","tags":["report"]},{"url":"https://bugzilla.suse.com/1217432","tags":["report"]},{"url":"https://bugzilla.suse.com/1219581","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-4750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22667","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240871-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241287-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-22667","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6698-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22667","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-22667","description":"Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.","status":"published","published":"2024-02-05T00:00:00Z","modified":"2025-11-04T22:05:40.794Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:34:00.254134Z"}],"euvd":[{"id":"EUVD-2024-20200","description":"Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.","status":"published","published":"2024-02-05T00:00:00Z","modified":"2025-11-04T22:05:40Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:20.707326Z"}],"ghsa":[{"id":"GHSA-jhwv-44fv-jwp5","title":"Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls...","description":"Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.","status":"published","published":"2024-02-05T09:30:28Z","modified":"2026-03-20T05:07:30Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:06:44.064136Z"}],"nvd":[{"id":"CVE-2024-22667","description":"Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.","status":"published","published":"2024-02-05T08:15:44.11Z","modified":"2026-06-17T07:11:40.25Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:09:34.891666Z"}],"osv":[{"id":"AZL-34281","title":"CVE-2024-22667 affecting package vim for versions less than 9.0.2121-2","description":"Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.","status":"published","published":"2024-02-05T08:15:44Z","modified":"2026-04-21T04:27:05.476992Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"BELL-CVE-2024-22667","status":"published","published":"2024-02-07T05:57:51.747882Z","modified":"2026-01-26T09:42:50.940466Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2024-22667","description":"Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.","status":"published","published":"2024-02-05T00:00:00Z","modified":"2026-10-28T02:30:30.608684886Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:38.577405Z"},{"id":"DEBIAN-CVE-2024-22667","description":"Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.","status":"published","published":"2024-02-05T08:15:44.11Z","modified":"2026-11-02T12:00:47.00991786Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"ROOT-OS-ALPINE-318-CVE-2024-22667","title":"CVE-2024-22667 in vim - Patched by Root","description":"Root has patched CVE-2024-22667 in the vim package for Root:Alpine:3.18. Multiple fixed versions available.","status":"published","published":"2026-09-29T10:47:56Z","modified":"2026-09-29T11:15:04.98102253Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"UBUNTU-CVE-2024-22667","description":"Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.","status":"published","published":"2024-02-05T08:15:00Z","modified":"2026-02-04T03:44:35.35563Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"CLSA-2024-1709563938","title":"vim: Fix of CVE-2024-22667","description":"- CVE-2024-22667: addressing a potential stack-buffer-overflow in option\n  processing functions","status":"published","published":"2024-03-04T14:52:22Z","modified":"2026-06-01T00:33:16.056775151Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1709564274","title":"vim: Fix of CVE-2024-22667","description":"- CVE-2024-22667: addressing a potential stack-buffer-overflow in option\n  processing functions","status":"published","published":"2024-03-04T14:57:57Z","modified":"2026-06-01T00:33:25.211878624Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1710436524","title":"Fix CVE(s): CVE-2024-22667","description":"   * SECURITY UPDATE: stack-buffer-overflow in option callback func\n     - debian/patches/CVE-2024-22667.patch: pass size of errbuf down\n       the call stack, use snprintf() instead of sprintf()\n     - CVE-2024-22667","status":"published","published":"2024-03-14T17:15:27Z","modified":"2026-06-04T10:04:26.195459Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1720776957","title":"vim: Fix of 10 CVEs","description":"- CVE-2023-0054: check the return value of vim_regsub()\n- CVE-2023-0049: avoid going over the NUL at the end\n- CVE-2023-0288: prevent the cursor from moving to line zero\n- CVE-2023-0433: check for not going over the end of the line\n- CVE-2023-2610: limit the text length to MAXCOL\n- CVE-2023-4750: check buffer is valid before accessing it\n- CVE-2023-4733: verify oldwin pointer after reset_VIsual()\n- CVE-2023-4751: stop Visual mode when using :ball\n- CVE-2023-5344: add NULL at end of buffer\n- CVE-2024-22667: pass size of errbuf down the call stack, use snprintf()","status":"published","published":"2024-07-12T09:36:00Z","modified":"2026-10-21T10:47:53.877511832Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2026-1787304699","title":"Fix of 10 CVEs","description":"   * SECURITY UPDATE: stack-based buffer overflow in option callback\n     functions: illegal_char() and did_set_string_option() wrote the\n     E539/E526/E535 option errors into the caller's 80-byte errbuf[] with\n     unbounded sprintf().  The call site reported upstream,\n     did_set_langmap() in src/map.c, does not exist in this version, where\n     'langmap' errors are reported through EMSG2() into a bounded buffer.\n     - debian/patches/CVE-2024-22667.patch: introduce ERR_BUFLEN and use\n       snprintf() bounded by it at the three sprintf() sites, in\n       src/option.c and src/option.h; matches upstream patch 9.0.2142.\n     - CVE-2024-22667\n   * SECURITY UPDATE: buffer overflow in 'helpfile' option handling:\n     get_tagfname() copied the user-controlled 'helpfile' value into a\n     MAXPATHL buffer with STRCPY() and then appended \"tags\" at the tail, so\n     an over-long 'helpfile' overflowed the buffer.\n     - debian/patches/CVE-2026-25749.patch: bound the copy with\n       vim_strncpy() leaving room for the \"tags\" suffix, in src/tag.c;\n       matches upstream patches 9.1.2132 and 9.1.2133.\n     - CVE-2026-25749\n   * SECURITY UPDATE: buffer overflow in the netbeans specialKeys command:\n     special_keys() walked the modifier prefix writing two bytes per\n     modifier into the 64-byte keybuf[] with no bound, so a long modifier\n     run overflowed it.\n     - debian/patches/CVE-2026-26269.patch: stop the modifier loop while\n       i + 2 \u003c KEYBUFLEN, in src/netbeans.c; matches upstream patch\n       9.1.2148.\n     - CVE-2026-26269\n   * SECURITY UPDATE: command injection via netrw URIs: the hostname and\n     port taken from a netrw URI were interpolated unescaped into the\n     command passed to system(), so shell metacharacters in the host or\n     port ran arbitrary commands.\n     - debian/patches/CVE-2026-28417.patch: validate the host against an\n       RFC1123 hostname / IPv4 / IPv6 pattern at the four netrw entry\n       points and shellescape() the host, user and port in s:MakeSshCmd(),\n       in runtime/autoload/netrw.vim; matches upstream patches 9.2.0073,\n       9.2.0089 and 9.2.0553.\n     - CVE-2026-28417\n   * SECURITY UPDATE: crash and huge allocation recovering a corrupted swap\n     file: ml_recover() trusted pe_page_count, pe_bnum, pe_old_lnum and\n     pe_line_count from the swap file, so bogus values caused a multi-GB\n     mf_get() allocation or a SEGV inside readfile().\n     - debian/patches/CVE-2026-28421.patch: bound pe_page_count and\n       pe_bnum against mf_blocknr_max and validate pe_old_lnum and\n       pe_line_count before use, in src/memline.c; matches upstream patch\n       9.2.0077.\n     - CVE-2026-28421\n   * SECURITY UPDATE: command injection via newline in glob(): the newline\n     character was missing from SHELL_SPECIAL, so it was not escaped before\n     mch_expand_wildcards() handed the pattern to the shell and could act\n     as a command separator.\n     - debian/patches/CVE-2026-33412.patch: add '\\n' to SHELL_SPECIAL, in\n       src/os_unix.c; matches upstream patch 9.2.0202.\n     - CVE-2026-33412\n   * SECURITY UPDATE: modeline security bypass: several options holding\n     expressions could be set from a modeline, so opening a crafted file\n     evaluated attacker-supplied expressions.  In this version the\n     expressions reachable this way are the 'statusline'-style %{} items of\n     'printheader' and 'guitabtooltip', which were evaluated in the sandbox\n     only; the F{func} flag of 'complete' and the mapset() function named by\n     the upstream advisory arrived in later releases and are not present in\n     this version.\n     - debian/patches/patch-8.1.1366-using-expressions-in-a-modeline-is-unsafe.patch:\n       add the 'modelineexpr' option and the P_MLE flag,\n       refuse P_MLE options in a modeline unless 'modelineexpr' is set,\n       mark the expression-bearing options P_MLE, and document\n       'modelineexpr' and E992, in src/option.c, src/option.h and\n       runtime/doc/options.txt; prerequisite for the fix below.\n     - debian/patches/patch-8.1.1367-can-set-modelineexpr-in-modeline.patch:\n       mark 'modelineexpr' itself P_SECURE so a modeline cannot enable it,\n       and document that, in src/option.c and runtime/doc/options.txt;\n       without this the check above can be turned off by the crafted file\n       itself.\n     - debian/patches/CVE-2026-34982.patch: mark 'complete',\n       'guitabtooltip' and 'printheader' P_MLE, in src/option.c; matches\n       upstream patch 9.2.0276.\n     - CVE-2026-34982\n   * SECURITY UPDATE: path traversal in zip.vim: neither zip#Write() nor\n     zip#Extract() rejected archive members whose path escaped the\n     extraction directory, so a crafted zip could write outside it.\n     - debian/patches/CVE-2026-35177.patch: reject any path that simplifies\n       to one containing \"../\" in both zip#Write() and zip#Extract(), in\n       runtime/autoload/zip.vim; matches upstream patch 9.2.0280.\n     - CVE-2026-35177\n   * SECURITY UPDATE: command injection in the netbeans interface via\n     defineAnnoType: typeName, fg and bg arrived unvalidated from the\n     NetBeans server and were interpolated into an Ex command, so a bar\n     could append arbitrary commands; specialKeys likewise built a map\n     command from an unvalidated key token.\n     - debian/patches/CVE-2026-39881.patch: validate typeName, fg and bg\n       against character allowlists and accept only alphanumerics and '-'\n       in a specialKeys token, in src/netbeans.c; matches upstream patch\n       9.2.0316.\n     - CVE-2026-39881\n   * SECURITY UPDATE: command injection via backticks in tag files:\n     expand_tag_fname() passed a tag filename containing backticks to\n     wildcard expansion, which ran it through the shell.\n     - debian/patches/CVE-2026-41411.patch: refuse to expand a tag filename\n       containing a backtick, in src/tag.c; matches upstream patch\n       9.2.0357.\n     - CVE-2026-41411\n   * NOTE: behaviour change that comes with the 'modelineexpr' mechanism\n     above: options that hold an expression ('balloonexpr', 'foldexpr',\n     'foldtext', 'formatexpr', 'guitablabel', 'iconstring', 'includeexpr',\n     'indentexpr', 'rulerformat', 'statusline', 'tabline', 'titlestring',\n     'complete', 'guitabtooltip' and 'printheader') can no longer be set\n     from a modeline unless the new 'modelineexpr' option is on, and are\n     refused with E992.  'cdpath' becomes modeline- and sandbox-refused\n     (E520).  This is the upstream 8.1.1366 behaviour; see\n     :help modelineexpr.\n   * debian/patches/fix-Test_terminal_cwd.patch: join the first two terminal\n     lines before comparing in Test_terminal_cwd(), so the test still passes\n     when the build path is long enough for the pwd output to wrap; matches\n     upstream patch 9.0.0541.","status":"published","published":"2026-08-21T09:31:57Z","modified":"2026-10-26T09:31:47.599230366Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"DLA-4097-1","title":"vim - security update","status":"published","published":"2025-03-30T00:00:00Z","modified":"2026-03-09T01:23:09.546419Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2024-0040","title":"Updated vim packages fix a security vulnerability","description":"The updated packages fix a security vulnerability:\nVim before 9.0.2142 has a stack-based buffer overflow because\ndid_set_langmap in map.c calls sprintf to write to the error buffer that\nis passed down to the option callback functions. (CVE-2024-22667)\n","status":"published","published":"2024-02-17T00:55:07Z","modified":"2026-04-16T04:41:49.325961561Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"SUSE-SU-2024:0783-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\n- CVE-2023-48231: Fixed  Use-After-Free in win_close() (bsc#1217316).\n- CVE-2023-48232: Fixed Floating point Exception in adjust_plines_for_skipcol() (bsc#1217320).\n- CVE-2023-48233: Fixed overflow with count for :s command (bsc#1217321).\n- CVE-2023-48234: Fixed overflow in nv_z_get_count (bsc#1217324).\n- CVE-2023-48235: Fixed overflow in ex address parsing (bsc#1217326).\n- CVE-2023-48236: Fixed overflow in get_number (bsc#1217329).\n- CVE-2023-48237: Fixed overflow in shift_line (bsc#1217330).\n- CVE-2023-48706: Fixed heap-use-after-free in ex_substitute (bsc#1217432).\n- CVE-2024-22667: Fixed stack-based buffer overflow in did_set_langmap function in map.c (bsc#1219581).\n- CVE-2023-4750: Fixed heap use-after-free in function bt_quickfix (bsc#1215005).\n\nUpdated to version 9.1 with patch level 0111:\nhttps://github.com/vim/vim/compare/v9.0.2103...v9.1.0111\n","status":"published","published":"2024-03-06T16:03:46Z","modified":"2026-02-04T04:08:05.227395Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0871-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\n- CVE-2023-48231: Fixed  Use-After-Free in win_close() (bsc#1217316).\n- CVE-2023-48232: Fixed Floating point Exception in adjust_plines_for_skipcol() (bsc#1217320).\n- CVE-2023-48233: Fixed overflow with count for :s command (bsc#1217321).\n- CVE-2023-48234: Fixed overflow in nv_z_get_count (bsc#1217324).\n- CVE-2023-48235: Fixed overflow in ex address parsing (bsc#1217326).\n- CVE-2023-48236: Fixed overflow in get_number (bsc#1217329).\n- CVE-2023-48237: Fixed overflow in shift_line (bsc#1217330).\n- CVE-2023-48706: Fixed heap-use-after-free in ex_substitute (bsc#1217432).\n- CVE-2024-22667: Fixed stack-based buffer overflow in did_set_langmap function in map.c (bsc#1219581).\n- CVE-2023-4750: Fixed heap use-after-free in function bt_quickfix (bsc#1215005).\n\nUpdated to version 9.1 with patch level 0111:\nhttps://github.com/vim/vim/compare/v9.0.2103...v9.1.0111\n","status":"published","published":"2024-03-13T12:08:05Z","modified":"2026-02-04T03:19:29.85601Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:1287-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\nUpdated to version 9.1.0111, fixes the following security problems\n\n- CVE-2023-48231: Use-After-Free in win_close() (bsc#1217316).\n- CVE-2023-48232: Floating point Exception in adjust_plines_for_skipcol() (bsc#1217320).\n- CVE-2023-48233: overflow with count for :s command (bsc#1217321).\n- CVE-2023-48234: overflow in nv_z_get_count (bsc#1217324).\n- CVE-2023-48235: overflow in ex address parsing (CVE-2023-48235).\n- CVE-2023-48236: overflow in get_number (bsc#1217329).\n- CVE-2023-48237: overflow in shift_line (bsc#1217330).\n- CVE-2023-48706: heap-use-after-free in ex_substitute (bsc#1217432).\n- CVE-2024-22667: stack-based buffer overflow in did_set_langmap function in map.c (bsc#1219581).\n- CVE-2023-4750: Heap use-after-free in function bt_quickfix (bsc#1215005).\n","status":"published","published":"2024-04-15T13:03:42Z","modified":"2026-02-04T03:23:50.683682Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"USN-6698-1","title":"vim vulnerability","description":"Zhen Zhou discovered that Vim did not properly manage memory. An\nattacker could possibly use this issue to cause a denial of service\n","status":"published","published":"2024-03-18T16:48:35Z","modified":"2026-06-29T13:51:06.989837169Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}