Lucene search

@huntrdevCVELIST:CVE-2021-3974

HistoryNov 19, 2021 - 12:00 a.m.

CVE-2021-3974 Use After Free in vim/vim

2021-11-1900:00:00

CWE-416

@huntrdev

www.cve.org

cve-2021-3974

vim

use after free

CVSS3

7.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

44.9%

JSON

vim is vulnerable to Use After Free

CNA Affected

[
  {
    "vendor": "vim",
    "product": "vim/vim",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "8.2.3612",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

www.openwall.com/lists/oss-security/2022/01/15/1

github.com/vim/vim/commit/64066b9acd9f8cffdf4840f797748f938a13f2d6

huntr.dev/bounties/e402cb2c-8ec4-4828-a692-c95f8e0de6d4

lists.debian.org/debian-lts-announce/2022/03/msg00018.html

lists.debian.org/debian-lts-announce/2022/11/msg00009.html

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IH2LS2DXBTYOCWGAKFMBF3HTWWXPBEFL/

security.gentoo.org/glsa/202208-32

CVSS3

7.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

44.9%

JSON

Related for CVELIST:CVE-2021-3974