Lucene search

@huntrdevCVELIST:CVE-2021-4136

HistoryDec 19, 2021 - 5:00 p.m.

CVE-2021-4136 Heap-based Buffer Overflow in vim/vim

2021-12-1917:00:10

CWE-122

@huntrdev

www.cve.org

cve-2021-4136

vim

vulnerable

buffer overflow

CVSS3

7.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

46.1%

JSON

vim is vulnerable to Heap-based Buffer Overflow

CNA Affected

[
  {
    "product": "vim/vim",
    "vendor": "vim",
    "versions": [
      {
        "lessThan": "8.2.3846",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

seclists.org/fulldisclosure/2022/Jul/14

seclists.org/fulldisclosure/2022/Mar/29

seclists.org/fulldisclosure/2022/May/35

www.openwall.com/lists/oss-security/2022/01/15/1

github.com/vim/vim/commit/605ec91e5a7330d61be313637e495fa02a6dc264

huntr.dev/bounties/5c6b93c1-2d27-4e98-a931-147877b8c938

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2EY2VFBU3YGGWI5BW4XKT3F37MYGEQUD/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3FH2J57GDA2WMBS6J56F6QQRA6BXQQFZ/

security.gentoo.org/glsa/202208-32

support.apple.com/kb/HT213183

support.apple.com/kb/HT213256

support.apple.com/kb/HT213343

CVSS3

7.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

46.1%

JSON

Related for CVELIST:CVE-2021-4136