8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.002 Low
EPSS
Percentile
57.2%
Issue Overview:
vim is vulnerable to Heap-based Buffer Overflow (CVE-2021-3903)
A flaw was found in vim. A possible heap-based buffer overflow could allow an attacker to input a specially crafted file leading to a crash or code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2021-3927)
A flaw was found in vim. A possible stack-based buffer overflow could allow an attacker to input a specially crafted file leading to a crash or code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2021-3928)
A flaw was found in vim. A possible heap use-after-free vulnerability could allow an attacker to input a specially crafted file leading to a crash or code execution. The highest threat from this vulnerability is to system availability. (CVE-2021-3968)
A flaw was found in vim. A possible heap-based buffer overflow could allow an attacker to input a specially crafted file leading to a crash or code execution. The highest threat from this vulnerability is to system availability. (CVE-2021-3973)
A flaw was found in vim. A possible use-after-free vulnerability could allow an attacker to input a specially crafted file leading to a crash or code execution. The highest threat from this vulnerability is to system availability. (CVE-2021-3974)
A flaw was found in vim. A possible heap-based buffer overflow allows an attacker to input a specially crafted file, leading to a crash or code execution. The highest threat from this vulnerability is confidentiality, integrity, and system availability. (CVE-2021-3984)
A flaw was found in vim. A possible heap-based buffer overflow vulnerability allows an attacker to input a specially crafted file, leading to a crash or code execution. The highest threat from this vulnerability is system availability. (CVE-2021-4019)
vim is vulnerable to Use After Free (CVE-2021-4069)
A flaw was found in vim. A possible heap-based buffer overflow could allow an attacker to input a specially crafted file leading to a crash or code execution. (CVE-2021-4136)
A flaw was found in vim. A possible heap-based buffer overflow could allow an attacker to input a specially crafted file leading to a crash or code execution. (CVE-2021-4166)
A flaw was found in vim. A possible use after free vulnerability could allow an attacker to input a specially crafted file leading to a crash or code execution. (CVE-2021-4173)
A flaw was found in vim. A possible use after free vulnerability could allow an attacker to input a specially crafted file leading to a crash or code execution. (CVE-2021-4187)
It was found that vim was vulnerable to use-after-free flaw in win_linetabsize(). Sourcing a specially crafted file in vim could crash the vim process or possibly lead to other undefined behaviors. (CVE-2021-4192)
It was found that vim was vulnerable to an out-of-bound read flaw in getvcol(). A specially crafted file could be used to, when opened in vim, disclose some of the process’s internal memory. (CVE-2021-4193)
References to CVE-2021-4192 and CVE-2021-4193 have been added after the original release of this advisory, however those vulnerabilities were fixed by the packages referenced by this advisory’s initial release on 2022-01-18.
Affected Packages:
vim
Issue Correction:
Run yum update vim to update your system.
New Packages:
i686:
vim-minimal-8.2.4006-1.1.amzn1.i686
vim-enhanced-8.2.4006-1.1.amzn1.i686
vim-common-8.2.4006-1.1.amzn1.i686
vim-debuginfo-8.2.4006-1.1.amzn1.i686
noarch:
vim-data-8.2.4006-1.1.amzn1.noarch
vim-filesystem-8.2.4006-1.1.amzn1.noarch
src:
vim-8.2.4006-1.1.amzn1.src
x86_64:
vim-enhanced-8.2.4006-1.1.amzn1.x86_64
vim-minimal-8.2.4006-1.1.amzn1.x86_64
vim-debuginfo-8.2.4006-1.1.amzn1.x86_64
vim-common-8.2.4006-1.1.amzn1.x86_64
Red Hat: CVE-2021-3903, CVE-2021-3927, CVE-2021-3928, CVE-2021-3968, CVE-2021-3973, CVE-2021-3974, CVE-2021-3984, CVE-2021-4019, CVE-2021-4069, CVE-2021-4136, CVE-2021-4166, CVE-2021-4173, CVE-2021-4187, CVE-2021-4192, CVE-2021-4193
Mitre: CVE-2021-3903, CVE-2021-3927, CVE-2021-3928, CVE-2021-3968, CVE-2021-3973, CVE-2021-3974, CVE-2021-3984, CVE-2021-4019, CVE-2021-4069, CVE-2021-4136, CVE-2021-4166, CVE-2021-4173, CVE-2021-4187, CVE-2021-4192, CVE-2021-4193
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Amazon Linux | 1 | i686 | vim-minimal | < 8.2.4006-1.1.amzn1 | vim-minimal-8.2.4006-1.1.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | vim-enhanced | < 8.2.4006-1.1.amzn1 | vim-enhanced-8.2.4006-1.1.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | vim-common | < 8.2.4006-1.1.amzn1 | vim-common-8.2.4006-1.1.amzn1.i686.rpm |
Amazon Linux | 1 | i686 | vim-debuginfo | < 8.2.4006-1.1.amzn1 | vim-debuginfo-8.2.4006-1.1.amzn1.i686.rpm |
Amazon Linux | 1 | noarch | vim-data | < 8.2.4006-1.1.amzn1 | vim-data-8.2.4006-1.1.amzn1.noarch.rpm |
Amazon Linux | 1 | noarch | vim-filesystem | < 8.2.4006-1.1.amzn1 | vim-filesystem-8.2.4006-1.1.amzn1.noarch.rpm |
Amazon Linux | 1 | x86_64 | vim-enhanced | < 8.2.4006-1.1.amzn1 | vim-enhanced-8.2.4006-1.1.amzn1.x86_64.rpm |
Amazon Linux | 1 | x86_64 | vim-minimal | < 8.2.4006-1.1.amzn1 | vim-minimal-8.2.4006-1.1.amzn1.x86_64.rpm |
Amazon Linux | 1 | x86_64 | vim-debuginfo | < 8.2.4006-1.1.amzn1 | vim-debuginfo-8.2.4006-1.1.amzn1.x86_64.rpm |
Amazon Linux | 1 | x86_64 | vim-common | < 8.2.4006-1.1.amzn1 | vim-common-8.2.4006-1.1.amzn1.x86_64.rpm |
8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.002 Low
EPSS
Percentile
57.2%