@huntrdevCVELIST:CVE-2021-4166

HistoryDec 25, 2021 - 6:15 p.m.

CVE-2021-4166 Out-of-bounds Read in vim/vim

2021-12-2518:15:09

CWE-125

@huntrdev

www.cve.org

7.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

8.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.5%

JSON

vim is vulnerable to Out-of-bounds Read

CNA Affected

[
  {
    "product": "vim/vim",
    "vendor": "vim",
    "versions": [
      {
        "lessThan": "8.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

seclists.org/fulldisclosure/2022/Jul/14

seclists.org/fulldisclosure/2022/Mar/29

seclists.org/fulldisclosure/2022/May/35

www.openwall.com/lists/oss-security/2022/01/15/1

github.com/vim/vim/commit/6f98371532fcff911b462d51bc64f2ce8a6ae682

huntr.dev/bounties/229df5dd-5507-44e9-832c-c70364bdf035

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2EY2VFBU3YGGWI5BW4XKT3F37MYGEQUD/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3FH2J57GDA2WMBS6J56F6QQRA6BXQQFZ/

security.gentoo.org/glsa/202208-32

support.apple.com/kb/HT213183

support.apple.com/kb/HT213256

support.apple.com/kb/HT213343

7.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

8.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.5%

JSON

Related for CVELIST:CVE-2021-4166