The vulnerability of the spell_dump_compl function in the spell.c component of the Vim text editor allows a hacker to gain access to confidential data, compromise its integrity, and cause service interruptions.

🗓️ 26 Oct 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

The Vim spell_dump_compl overflow in spell.c can leak data, harm integrity, and disrupt service.

Reporter	Title	Published	Views	Family All 141
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Vim-minimal Package Issues (2)	1 Aug 202417:22	–	ibm
Tenable Nessus	Amazon Linux 2022 : vim-common, vim-data, vim-default-editor (ALAS2022-2022-155)	20 Oct 202200:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-098)	21 Mar 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : vim (ALAS-2022-1868)	21 Oct 202200:00	–	nessus
Tenable Nessus	Amazon Linux AMI : vim (ALAS-2022-1639)	21 Oct 202200:00	–	nessus
Tenable Nessus	Debian dla-3182 : vim - security update	10 Nov 202200:00	–	nessus
Tenable Nessus	Debian dla-4097 : vim - security update	30 Mar 202500:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : vim (EulerOS-SA-2022-2307)	14 Sep 202200:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP9 : vim (EulerOS-SA-2022-2336)	14 Sep 202200:00	–	nessus
Tenable Nessus	EulerOS Virtualization 2.9.1 : vim (EulerOS-SA-2022-2369)	24 Sep 202200:00	–	nessus

Source	Link
github	www.github.com/vim/vim/commit/54e5fed6d27b747ff152cdb6edfb72ff60e70939
huntr	www.huntr.dev/bounties/eb7402f3-025a-402f-97a7-c38700d9548a
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-2304
security-tracker	www.security-tracker.debian.org/tracker/CVE-2022-2304
wiki	www.wiki.astralinux.ru/astra-linux-se17-bulletin-2022-1011SE17MD
wiki	www.wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47
altsp	www.altsp.su/obnovleniya-bezopasnosti/
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.6/
wiki	www.wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81
web	www.web.nvd.nist.gov/view/vuln/detail

13 Sep 2024 00:00Current

7.6High risk

Vulners AI Score7.6

CVSS 38.8

CVSS 29.3

EPSS0.01408

spell_dump_compl buffer overflow data leakage integrity impact service disruption vim spell