Low: vim

Issue Overview:

A flaw was found in vim, which is vulnerable to an out-of-bounds read in the msg_outtrans_special function. This flaw allows a specially crafted file to crash software or execute code when opened in vim. (CVE-2022-2257)

A heap buffer overflow vulnerability was found in Vim’s inc() function of misc2.c. This issue occurs because Vim reads beyond the end of the line with a put command. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering an out-of-bounds read that causes a crash in the CLI tool. (CVE-2022-2264)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. (CVE-2022-2284)

Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0. (CVE-2022-2285)

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. (CVE-2022-2286)

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. (CVE-2022-2287)

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0. (CVE-2022-2288)

Use After Free in GitHub repository vim/vim prior to 9.0. (CVE-2022-2289)

A stack-based buffer overflow vulnerability was found in Vim’s spell_dump_compl() function of the src/spell.c file. This issue occurs because the spell dump goes beyond the end of an array when crafted input is processed. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering an out-of-bounds write that causes an application to crash, possibly executing code and corrupting memory. (CVE-2022-2304)

A heap-based buffer overflow was found in Vim in the ins_compl_add function in the insexpand.c file. This issue occurs due to a read past the end of a buffer when a specially crafted input is processed. This flaw allows an attacker who can trick a user into opening a specially crafted file into triggering the heap-based buffer overflow, causing the application to crash, possibly executing code and corrupting memory. (CVE-2022-2343)

A heap-based buffer overflow was found in Vim in the ins_compl_add function in the insexpand.c file. This issue occurs due to a read past the end of a buffer when a specially crafted input is processed. This flaw allows an attacker who can trick a user into opening a specially crafted file into triggering the heap-based buffer overflow, causing the application to crash, possibly executing code and corrupting memory. (CVE-2022-2344)

A use-after-free vulnerability was found in Vim in the skipwhite function in the charset.c file. This issue occurs because an already freed memory is used when a specially crafted input is processed. This flaw allows an attacker who can trick a user into opening a specially crafted file into triggering the use-after-free, and cause the application to crash, possibly executing code and corrupting memory. (CVE-2022-2345)

An out-of-bounds read vulnerability was found in Vim in the check_vim9_unlet function in the vim9cmds.c file. This issue occurs because of invalid memory access when compiling the unlet command when a specially crafted input is processed. This flaw allows an attacker who can trick a user into opening a specially crafted file into triggering the out-of-bounds read, causing the application to crash, possibly executing code and corrupting memory. (CVE-2022-2816)

A use-after-free vulnerability was found in Vim in the string_quote function in the strings.c file. This issue occurs because an already freed memory is used when a specially crafted input is processed. This flaw allows an attacker who can trick a user into opening a specially crafted file into triggering the use-after-free, causing the application to crash, possibly executing code and corrupting memory. (CVE-2022-2817)

A flaw was found in vim. The vulnerability occurs due to illegal memory access and leads to a heap buffer overflow vulnerability. This flaw allows an attacker to input a specially crafted file, leading to a crash or code execution. (CVE-2022-2819)

Buffer Over-read in GitHub repository vim/vim prior to 9.0.0218. (CVE-2022-2845)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220. (CVE-2022-2849)

Use After Free in GitHub repository vim/vim prior to 9.0.0221. (CVE-2022-2862)

A use-after-free vulnerability was found in Vim in the find_var_also_in_script function in the evalvars.c file. This issue occurs because an already freed memory is used when a specially crafted input is processed. This flaw allows an attacker who can trick a user into opening a specially crafted file into triggering the use-after-free, causing the application to crash, possibly executing code and corrupting memory. (CVE-2022-2889)

A flaw was found in vim, where it is vulnerable to a NULL pointer dereference in the sug_filltree function. This flaw allows a specially crafted file to crash the software. (CVE-2022-2923)

A flaw was found in vim, where it is vulnerable to a use-after-free in the vim_vsnprintf_typval function. This flaw allows a specially crafted file to crash a program, use unexpected values, or execute code. (CVE-2022-2946)

A NULL pointer dereference vulnerability was found in vim’s do_mouse() function of the src/mouse.c file. The issue occurs with a mouse click when it is not initialized. This flaw allows an attacker to trick a user into opening a specially crafted input file, triggering the vulnerability that could cause an application to crash. (CVE-2022-2980)

A heap use-after-free vulnerability was found in vim’s qf_fill_buffer() function of the src/quickfix.c file. The issue occurs because vim uses freed memory when recursively using ‘quickfixtextfunc.’ This flaw allows an attacker to trick a user into opening a specially crafted file, triggering a heap use-after-free that causes an application to crash, possibly executing code and corrupting memory. (CVE-2022-2982)

A heap use-after-free vulnerability was found in vim’s get_next_valid_entry() function of the src/quickfix.c file. The issue occurs because vim is using freed memory when the location list is changed in autocmd. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering a heap use-after-free that causes an application to crash, possibly executing code and corrupting memory. (CVE-2022-3016)

Use After Free in GitHub repository vim/vim prior to 9.0.0322. (CVE-2022-3037)

A use-after-free vulnerability was found in vim’s do_cmdline() function of the src/ex_docmd.c file. The issue triggers when an invalid line number on :for is ignored. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering use-after-free that causes an application to crash, possibly executing code and corrupting memory. (CVE-2022-3099)

Affected Packages:

vim

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update vim to update your system.

New Packages:

aarch64:  
    vim-common-9.0.475-1.amzn2.0.1.aarch64  
    vim-minimal-9.0.475-1.amzn2.0.1.aarch64  
    vim-enhanced-9.0.475-1.amzn2.0.1.aarch64  
    vim-X11-9.0.475-1.amzn2.0.1.aarch64  
    vim-debuginfo-9.0.475-1.amzn2.0.1.aarch64  
  
i686:  
    vim-common-9.0.475-1.amzn2.0.1.i686  
    vim-minimal-9.0.475-1.amzn2.0.1.i686  
    vim-enhanced-9.0.475-1.amzn2.0.1.i686  
    vim-X11-9.0.475-1.amzn2.0.1.i686  
    vim-debuginfo-9.0.475-1.amzn2.0.1.i686  
  
noarch:  
    vim-filesystem-9.0.475-1.amzn2.0.1.noarch  
    vim-data-9.0.475-1.amzn2.0.1.noarch  
  
src:  
    vim-9.0.475-1.amzn2.0.1.src  
  
x86_64:  
    vim-common-9.0.475-1.amzn2.0.1.x86_64  
    vim-minimal-9.0.475-1.amzn2.0.1.x86_64  
    vim-enhanced-9.0.475-1.amzn2.0.1.x86_64  
    vim-X11-9.0.475-1.amzn2.0.1.x86_64  
    vim-debuginfo-9.0.475-1.amzn2.0.1.x86_64  

Additional References

Red Hat: CVE-2022-2257, CVE-2022-2264, CVE-2022-2284, CVE-2022-2285, CVE-2022-2286, CVE-2022-2287, CVE-2022-2288, CVE-2022-2289, CVE-2022-2304, CVE-2022-2343, CVE-2022-2344, CVE-2022-2345, CVE-2022-2816, CVE-2022-2817, CVE-2022-2819, CVE-2022-2845, CVE-2022-2849, CVE-2022-2862, CVE-2022-2889, CVE-2022-2923, CVE-2022-2946, CVE-2022-2980, CVE-2022-2982, CVE-2022-3016, CVE-2022-3037, CVE-2022-3099

Mitre: CVE-2022-2257, CVE-2022-2264, CVE-2022-2284, CVE-2022-2285, CVE-2022-2286, CVE-2022-2287, CVE-2022-2288, CVE-2022-2289, CVE-2022-2304, CVE-2022-2343, CVE-2022-2344, CVE-2022-2345, CVE-2022-2816, CVE-2022-2817, CVE-2022-2819, CVE-2022-2845, CVE-2022-2849, CVE-2022-2862, CVE-2022-2889, CVE-2022-2923, CVE-2022-2946, CVE-2022-2980, CVE-2022-2982, CVE-2022-3016, CVE-2022-3037, CVE-2022-3099