Low: vim

Issue Overview:

A flaw was found in vim, which is vulnerable to an out-of-bounds read in the msg_outtrans_special function. This flaw allows a specially crafted file to crash software or execute code when opened in vim. (CVE-2022-2257)

A heap buffer overflow vulnerability was found in Vim’s inc() function of misc2.c. This issue occurs because Vim reads beyond the end of the line with a put command. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering an out-of-bounds read that causes a crash in the CLI tool. (CVE-2022-2264)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. (CVE-2022-2284)

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0. (CVE-2022-2285)

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. (CVE-2022-2286)

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. (CVE-2022-2287)

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0. (CVE-2022-2288)

Use After Free in GitHub repository vim/vim prior to 9.0. (CVE-2022-2289)

A stack-based buffer overflow vulnerability was found in Vim’s spell_dump_compl() function of the src/spell.c file. This issue occurs because the spell dump goes beyond the end of an array when crafted input is processed. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering an out-of-bounds write that causes an application to crash, possibly executing code and corrupting memory. (CVE-2022-2304)

A heap-based buffer overflow was found in Vim in the ins_compl_add function in the insexpand.c file. This issue occurs due to a read past the end of a buffer when a specially crafted input is processed. This flaw allows an attacker who can trick a user into opening a specially crafted file into triggering the heap-based buffer overflow, causing the application to crash, possibly executing code and corrupting memory. (CVE-2022-2343)

A heap-based buffer overflow was found in Vim in the ins_compl_add function in the insexpand.c file. This issue occurs due to a read past the end of a buffer when a specially crafted input is processed. This flaw allows an attacker who can trick a user into opening a specially crafted file into triggering the heap-based buffer overflow, causing the application to crash, possibly executing code and corrupting memory. (CVE-2022-2344)

A use-after-free vulnerability was found in Vim in the skipwhite function in the charset.c file. This issue occurs because an already freed memory is used when a specially crafted input is processed. This flaw allows an attacker who can trick a user into opening a specially crafted file into triggering the use-after-free, and cause the application to crash, possibly executing code and corrupting memory. (CVE-2022-2345)

An out-of-bounds read vulnerability was found in Vim in the check_vim9_unlet function in the vim9cmds.c file. This issue occurs because of invalid memory access when compiling the unlet command when a specially crafted input is processed. This flaw allows an attacker who can trick a user into opening a specially crafted file into triggering the out-of-bounds read, causing the application to crash, possibly executing code and corrupting memory. (CVE-2022-2816)

A use-after-free vulnerability was found in Vim in the string_quote function in the strings.c file. This issue occurs because an already freed memory is used when a specially crafted input is processed. This flaw allows an attacker who can trick a user into opening a specially crafted file into triggering the use-after-free, causing the application to crash, possibly executing code and corrupting memory. (CVE-2022-2817)

A flaw was found in vim. The vulnerability occurs due to illegal memory access and leads to a heap buffer overflow vulnerability. This flaw allows an attacker to input a specially crafted file, leading to a crash or code execution. (CVE-2022-2819)

Use After Free in GitHub repository vim/vim prior to 9.0.0322. (CVE-2022-3037)

Affected Packages:

vim

Issue Correction:
Run yum update vim to update your system.

New Packages:

i686:  
    vim-debuginfo-9.0.475-1.1.amzn1.i686  
    vim-common-9.0.475-1.1.amzn1.i686  
    vim-minimal-9.0.475-1.1.amzn1.i686  
    vim-enhanced-9.0.475-1.1.amzn1.i686  
  
noarch:  
    vim-data-9.0.475-1.1.amzn1.noarch  
    vim-filesystem-9.0.475-1.1.amzn1.noarch  
  
src:  
    vim-9.0.475-1.1.amzn1.src  
  
x86_64:  
    vim-enhanced-9.0.475-1.1.amzn1.x86_64  
    vim-common-9.0.475-1.1.amzn1.x86_64  
    vim-debuginfo-9.0.475-1.1.amzn1.x86_64  
    vim-minimal-9.0.475-1.1.amzn1.x86_64  

Additional References

Red Hat: CVE-2022-2257, CVE-2022-2264, CVE-2022-2284, CVE-2022-2285, CVE-2022-2286, CVE-2022-2287, CVE-2022-2288, CVE-2022-2289, CVE-2022-2304, CVE-2022-2343, CVE-2022-2344, CVE-2022-2345, CVE-2022-2816, CVE-2022-2817, CVE-2022-2819, CVE-2022-3037

Mitre: CVE-2022-2257, CVE-2022-2264, CVE-2022-2284, CVE-2022-2285, CVE-2022-2286, CVE-2022-2287, CVE-2022-2288, CVE-2022-2289, CVE-2022-2304, CVE-2022-2343, CVE-2022-2344, CVE-2022-2345, CVE-2022-2816, CVE-2022-2817, CVE-2022-2819, CVE-2022-3037