Lucene search

K
slackwareSlackware Linux ProjectSSA-2022-269-02
HistorySep 26, 2022 - 7:50 p.m.

[slackware-security] vim

2022-09-2619:50:40
Slackware Linux Project
www.slackware.com
22

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.4 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

43.5%

New vim packages are available for Slackware 15.0 and -current to
fix a security issue.

Here are the details from the Slackware 15.0 ChangeLog:

patches/packages/vim-9.0.0594-i586-1_slack15.0.txz: Upgraded.
Fixed stack-based buffer overflow.
Thanks to marav for the heads-up.
In addition, Mig21 pointed out an issue where the defaults.vim file might
need to be edited for some purposes as its contents will override the
settings in the system-wide vimrc. Usually this file is replaced whenever
vim is upgraded, which in those situations would be inconvenient for the
admin. So, I’ve added support for a file named defaults.vim.custom which
(if it exists) will be used instead of the defaults.vim file shipped in
the packages and will persist through upgrades.
For more information, see:
https://vulners.com/cve/CVE-2022-3296
(* Security fix *)
patches/packages/vim-gvim-9.0.0594-i586-1_slack15.0.txz: Upgraded.

Where to find the new packages:

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the “Get Slack” section on http://slackware.com for
additional mirror sites near you.

Updated packages for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/vim-9.0.0594-i586-1_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/vim-gvim-9.0.0594-i586-1_slack15.0.txz

Updated packages for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/vim-9.0.0594-x86_64-1_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/vim-gvim-9.0.0594-x86_64-1_slack15.0.txz

Updated packages for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/vim-9.0.0594-i586-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/xap/vim-gvim-9.0.0594-i586-1.txz

Updated packages for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ap/vim-9.0.0594-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/xap/vim-gvim-9.0.0594-x86_64-1.txz

MD5 signatures:

Slackware 15.0 packages:
1b0cb487c5c2c3b6cb26e9b89e6f2cee vim-9.0.0594-i586-1_slack15.0.txz
992c76a5513d257ce254a74a475cdfce vim-gvim-9.0.0594-i586-1_slack15.0.txz

Slackware x86_64 15.0 packages:
e26ff833be864ce0918573fbd30c8603 vim-9.0.0594-x86_64-1_slack15.0.txz
7526ef9c18d8493b92e10401682b83db vim-gvim-9.0.0594-x86_64-1_slack15.0.txz

Slackware -current packages:
2430111745328ac8c0087bef7d1030a7 ap/vim-9.0.0594-i586-1.txz
f59dd40be3a5b9ac827d9efe34e41157 xap/vim-gvim-9.0.0594-i586-1.txz

Slackware x86_64 -current packages:
2b400b18679446912cd6ea0a96f819ea ap/vim-9.0.0594-x86_64-1.txz
09a1dc77ae1b533871e65f732299f931 xap/vim-gvim-9.0.0594-x86_64-1.txz

Installation instructions:

Upgrade the packages as root:
> upgradepkg vim-9.0.0594-i586-1_slack15.0.txz vim-gvim-9.0.0594-i586-1_slack15.0.txz

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.4 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

43.5%