The vulnerability in the findfile.c component of the Vim text editor allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

🗓️ 26 Sep 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Vim findfile.c vulnerability from improper handling of control w f with no file name; risks data breach, integrity loss, and service failures.

Reporter	Title	Published	Views	Family All 124
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Vim-minimal Package Issues	8 Aug 202417:27	–	ibm
IBM Security Bulletins	Security Bulletin: EDB PGAI Databases is affected by Multiple Vulnerabilities.	7 Apr 202613:55	–	ibm
Tenable Nessus	Amazon Linux 2022 : vim-common, vim-data, vim-default-editor (ALAS2022-2021-005)	11 Dec 202400:00	–	nessus
Tenable Nessus	Amazon Linux 2022 : vim-common, vim-data, vim-default-editor (ALAS2022-2022-155)	20 Oct 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-098)	21 Mar 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : vim (ALAS-2021-1728)	10 Dec 202100:00	–	nessus
Tenable Nessus	Amazon Linux AMI : vim (ALAS-2022-1557)	20 Jan 202200:00	–	nessus
Tenable Nessus	Debian DLA-2947-1 : vim - LTS security update	16 Mar 202200:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : vim (EulerOS-SA-2022-1297)	2 Mar 202200:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : vim (EulerOS-SA-2022-1313)	2 Mar 202200:00	–	nessus

Source	Link
github	www.github.com/vim/vim/commit/615ddd5342b50a6878a907062aa471740bd9a847
huntr	www.huntr.dev/bounties/ce6e8609-77c6-4e17-b9fc-a2e5abed052e
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-3973
security-tracker	www.security-tracker.debian.org/tracker/CVE-2021-3973
wiki	www.wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16
wiki	www.wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1011SE17MD
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.6/
wiki	www.wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47
wiki	www.wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81
strelets	www.strelets.net/patchi-i-obnovleniya-bezopasnosti

21 Nov 2023 00:00Current

7.1High risk

Vulners AI Score7.1

CVSS 38.8

CVSS 29.3

EPSS0.00358

Vim findfile.c control w f file name absent confidential data data integrity service failures