vim is vulnerable to Heap-based Buffer Overflow

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-014 advisory.

    A flaw was found in vim. A possible heap-based buffer overflow vulnerability allows an attacker to input a     specially crafted file, leading to a crash or code execution. The highest threat from this vulnerability     is system availability. (CVE-2021-4019)

    vim is vulnerable to Use After Free (CVE-2021-4069)

    A flaw was found in vim. A possible heap-based buffer overflow could allow an attacker to input a     specially crafted file leading to a crash or code execution. (CVE-2021-4136)

    A flaw was found in vim. A possible heap-based buffer overflow could allow an attacker to input a     specially crafted file leading to a crash or code execution. (CVE-2021-4166)

    A flaw was found in vim. A possible use after free vulnerability could allow an attacker to input a     specially crafted file leading to a crash or code execution. (CVE-2021-4173)

    A flaw was found in vim. A possible use after free vulnerability could allow an attacker to input a     specially crafted file leading to a crash or code execution. (CVE-2021-4187)

    It was found that vim was vulnerable to use-after-free flaw in win_linetabsize(). Sourcing a specially     crafted file in vim could crash the vim process or possibly lead to other undefined behaviors.
    (CVE-2021-4192)

    It was found that vim was vulnerable to an out-of-bound read flaw in getvcol(). A specially crafted file     could be used to, when opened in vim, disclose some of the process's internal memory. (CVE-2021-4193)

    vim is vulnerable to Out-of-bounds Read (CVE-2022-0128)

    It was found that vim was vulnerable to use-after-free flaw in the way it was treating allocated lines in     user functions. A specially crafted file could crash the vim process or possibly lead to other undefined     behaviors. (CVE-2022-0156)

    It was found that vim was vulnerable to a 1 byte heap based out of bounds read flaw in the     `compile_get_env()` function. A file could use that flaw to disclose 1 byte of vim's internal memory.
    (CVE-2022-0158)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the vim package has been released.

The remote Ubuntu 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6195-1 advisory.

    It was discovered that Vim contained an out-of-bounds read vulnerability. An attacker could possibly use     this issue to cause a denial of service or

    execute arbitrary code. (CVE-2022-0128)

    It was discovered that Vim did not properly manage memory when freeing allocated memory. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2022-0156)

    It was discovered that Vim contained a heap-based buffer overflow vulnerability. An attacker could     possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2022-0158)

    It was discovered that Vim did not properly manage memory when recording and using select mode. An     attacker could possibly use this issue to cause a denial of service. (CVE-2022-0393)

    It was discovered that Vim incorrectly handled certain memory operations during a visual block yank. An     attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
    (CVE-2022-0407)

    It was discovered that Vim contained a NULL pointer dereference vulnerability when switching tabpages. An     attacker could possible use this issue to cause a denial of service. (CVE-2022-0696)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-155 advisory.

    A use-after-free vulnerability was found in vim's do_cmdline() function of the src/ex_docmd.c file. The     issue triggers when an invalid line number on :for is ignored. This flaw allows an attacker to trick a     user into opening a specially crafted file, triggering use-after-free that causes an application to crash,     possibly executing code and corrupting memory. (CVE-2022-3099)

    A heap use-after-free vulnerability was found in vim's do_tag() function of the src/tag.c file. The issue     triggers when the 'tagfunc' closes the window. This flaw allows an attacker to trick a user into opening a     specially crafted file, triggering a heap use-after-free that causes an application to crash, possibly     executing code and corrupting memory. (CVE-2022-3134)

    NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. (CVE-2022-3153)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202208-32 (Vim, gVim: Multiple Vulnerabilities)

  - vim is vulnerable to Heap-based Buffer Overflow (CVE-2021-3770, CVE-2021-3778, CVE-2021-3872,     CVE-2021-3875, CVE-2021-3927, CVE-2021-3968, CVE-2021-3973, CVE-2021-3984, CVE-2021-4019, CVE-2021-4136,     CVE-2022-0158, CVE-2022-0213)

  - vim is vulnerable to Use After Free (CVE-2021-3796, CVE-2021-3974, CVE-2021-4069, CVE-2021-4173,     CVE-2021-4187, CVE-2021-4192, CVE-2022-0156)

  - vim is vulnerable to Use of Uninitialized Variable (CVE-2021-3928)

  - vim is vulnerable to Out-of-bounds Read (CVE-2021-4166, CVE-2021-4193, CVE-2022-0128)

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by     its CNA. Further investigation showed that it was not a security issue. Notes: none. (CVE-2021-46059)

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. (CVE-2022-0261, CVE-2022-0359,     CVE-2022-0361, CVE-2022-0407, CVE-2022-1886, CVE-2022-1942, CVE-2022-2125, CVE-2022-2182, CVE-2022-2207)

  - Heap-based Buffer Overflow in vim/vim prior to 8.2. (CVE-2022-0318)

  - Out-of-bounds Read in vim/vim prior to 8.2. (CVE-2022-0319)

  - Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.
    (CVE-2022-0351)

  - Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. (CVE-2022-0368, CVE-2022-0393,     CVE-2022-1851, CVE-2022-2126, CVE-2022-2183, CVE-2022-2206)

  - Heap-based Buffer Overflow in GitHub repository vim prior to 8.2. (CVE-2022-0392)

  - Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. (CVE-2022-0408, CVE-2022-0629)

  - Use After Free in GitHub repository vim/vim prior to 8.2. (CVE-2022-0413, CVE-2022-0443, CVE-2022-1898,     CVE-2022-1968, CVE-2022-2042)

  - Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2. (CVE-2022-0417)

  - Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2. (CVE-2022-0554)

  - Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418. (CVE-2022-0685)

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436. (CVE-2022-0714)

  - Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. (CVE-2022-0729)

  - Heap-based Buffer Overflow occurs in vim in GitHub repository vim/vim prior to 8.2.4563. (CVE-2022-0943)

  - Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646. (CVE-2022-1154)

  - heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647. (CVE-2022-1160)

  - global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This     vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible     remote execution (CVE-2022-1381)

  - Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774. (CVE-2022-1420)

  - Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is     capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution     (CVE-2022-1616)

  - Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899.
    This vulnerabilities are capable of crashing software, modify memory, and possible remote execution     (CVE-2022-1619)

  - NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim     prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows     attackers to cause a denial of service (application crash) via a crafted input. (CVE-2022-1620)

  - Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This     vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible     remote execution (CVE-2022-1621)

  - Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This     vulnerabilities are capable of crashing software, Modify Memory, and possible remote execution     (CVE-2022-1629)

  - NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim     prior to 8.2.4938. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 allows     attackers to cause a denial of service (application crash) via a crafted input. (CVE-2022-1674)

  - Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This     vulnerability is capable of crashing the software, memory modification, and possible remote execution.
    (CVE-2022-1720)

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4968. (CVE-2022-1733)

  - Classic Buffer Overflow in GitHub repository vim/vim prior to 8.2.4969. (CVE-2022-1735)

  - Buffer Over-read in GitHub repository vim/vim prior to 8.2.4974. (CVE-2022-1769)

  - Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975. (CVE-2022-1771)

  - Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.4977. (CVE-2022-1785)

  - Use After Free in GitHub repository vim/vim prior to 8.2.4979. (CVE-2022-1796)

  - Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. (CVE-2022-1897, CVE-2022-2000,     CVE-2022-2129, CVE-2022-2210)

  - Buffer Over-read in GitHub repository vim/vim prior to 8.2. (CVE-2022-1927, CVE-2022-2124, CVE-2022-2175)

  - NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163. (CVE-2022-2208)

  - NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2. (CVE-2022-2231)

  - Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. (CVE-2022-2257, CVE-2022-2286,     CVE-2022-2287)

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. (CVE-2022-2264, CVE-2022-2284)

  - Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0. (CVE-2022-2285)

  - Out-of-bounds Write in GitHub repository vim/vim prior to 9.0. (CVE-2022-2288)

  - Use After Free in GitHub repository vim/vim prior to 9.0. (CVE-2022-2289)

  - Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. (CVE-2022-2304)

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044. (CVE-2022-2343)

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045. (CVE-2022-2344)

  - Use After Free in GitHub repository vim/vim prior to 9.0.0046. (CVE-2022-2345)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 11.x prior to 11.6.8 Big Sur. It is, therefore, affected by multiple vulnerabilities :

  - An out-of-bounds write issue vulnerability may lead to arbitrary code execution. (CVE-2022-32787)

  - Exploitation of this vulnerability may lead to arbitrary code execution with kernel privileges. (CVE-2022-32812)

  - Exploitation of this vulnerability may lead to access of sensitive user information. (CVE-2022-32834) 

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.3 Monterey. It is, therefore, affected by multiple vulnerabilities, including the following:
  - A use after free issue was addressed with improved memory management. Successful exploitation could   result in arbitrary code execution with kernel privileges (CVE-2022-22614). 

  - A logic issue was addressed with improved state management. Successful exploitation could result in   privilege escalation (CVE-2022-22632).

  - A null pointer dereference was addressed with improved validation. Successful exploitation could   result in a denial of service condition. (CVE-2022-22638).

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1751 advisory.

    It was found that vim was vulnerable to use-after-free flaw in the way it was treating allocated lines in     user functions. A specially crafted file could crash the vim process or possibly lead to other undefined     behaviors. (CVE-2022-0156)

    It was found that vim was vulnerable to a 1 byte heap based out of bounds read flaw in the     `compile_get_env()` function. A file could use that flaw to disclose 1 byte of vim's internal memory.
    (CVE-2022-0158)

    A flaw was found in vim.  The vulnerability occurs due to not checking the length for the NameBuff     function, which can lead to a heap buffer overflow. This flaw allows an attacker to input a specially     crafted file, leading to a crash or code execution. (CVE-2022-0213)

    A heap based out-of-bounds write flaw was found in vim's ops.c. This flaw allows an attacker to trick a     user to open a crafted file triggering an out-of-bounds write. This vulnerability is capable of crashing     software, modify memory, and possible code execution. (CVE-2022-0261)

    A flaw was found in vim.  The vulnerability occurs due to reading beyond the end of a line in the     utf_head_off function, which can lead to a heap buffer overflow. This flaw allows an attacker to input a     specially crafted file, leading to a crash or code execution. (CVE-2022-0318)

    A flaw was found in vim. The vulnerability occurs due to too many recursions, which can lead to a     segmentation fault. This flaw allows an attacker to input a specially crafted file, leading to a crash or     code execution. (CVE-2022-0351)

    A flaw was found in vim. The vulnerability occurs due to Illegal memory access with large tabstop in Ex     mode, which can lead to a heap buffer overflow. This flaw allows an attacker to input a specially crafted     file, leading to a crash or code execution. (CVE-2022-0359)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1567 advisory.

    2024-02-14: CVE-2021-3778 was added to this advisory.

    2024-02-14: CVE-2021-3875 was added to this advisory.

    2024-02-14: CVE-2021-3872 was added to this advisory.

    A flaw was found in vim. A possible heap-based buffer overflow could allow an attacker to input a     specially crafted file leading to a crash or code execution. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system availability. (CVE-2021-3778)

    An out-of-bounds write flaw was found in vim's drawscreen.c win_redr_status() function. This flaw allows     an attacker to trick a user to open a crafted file with specific arguments in vim, triggering an out-of-     bounds write. The highest threat from this vulnerability is to confidentiality, integrity, and system     availability. (CVE-2021-3872)

    There's an out-of-bounds read flaw in Vim's ex_docmd.c. An attacker who is capable of tricking a user into     opening a specially crafted file could trigger an out-of-bounds read on a memmove operation, potentially     causing an impact to application availability. (CVE-2021-3875)

    It was found that vim was vulnerable to use-after-free flaw in the way it was treating allocated lines in     user functions. A specially crafted file could crash the vim process or possibly lead to other undefined     behaviors. (CVE-2022-0156)

    It was found that vim was vulnerable to a 1 byte heap based out of bounds read flaw in the     `compile_get_env()` function. A file could use that flaw to disclose 1 byte of vim's internal memory.
    (CVE-2022-0158)

    A flaw was found in vim.  The vulnerability occurs due to not checking the length for the NameBuff     function, which can lead to a heap buffer overflow. This flaw allows an attacker to input a specially     crafted file, leading to a crash or code execution. (CVE-2022-0213)

    A heap based out-of-bounds write flaw was found in vim's ops.c. This flaw allows an attacker to trick a     user to open a crafted file triggering an out-of-bounds write. This vulnerability is capable of crashing     software, modify memory, and possible code execution. (CVE-2022-0261)

    A flaw was found in vim.  The vulnerability occurs due to reading beyond the end of a line in the     utf_head_off function, which can lead to a heap buffer overflow. This flaw allows an attacker to input a     specially crafted file, leading to a crash or code execution. (CVE-2022-0318)

    A flaw was found in vim. The vulnerability occurs due to too many recursions, which can lead to a     segmentation fault. This flaw allows an attacker to input a specially crafted file, leading to a crash or     code execution. (CVE-2022-0351)

    A flaw was found in vim. The vulnerability occurs due to Illegal memory access with large tabstop in Ex     mode, which can lead to a heap buffer overflow. This flaw allows an attacker to input a specially crafted     file, leading to a crash or code execution. (CVE-2022-0359)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
212465	Amazon Linux 2022 : vim-common, vim-data, vim-default-editor (ALAS2022-2022-014)	Nessus	Amazon Linux Local Security Checks	high
204080	Photon OS 3.0: Vim PHSA-2022-3.0-0380	Nessus	PhotonOS Local Security Checks	high
203437	Photon OS 4.0: Vim PHSA-2022-4.0-0161	Nessus	PhotonOS Local Security Checks	high
177891	Ubuntu 22.04 LTS : Vim vulnerabilities (USN-6195-1)	Nessus	Ubuntu Local Security Checks	high
173115	Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-098)	Nessus	Amazon Linux Local Security Checks	critical
166352	Amazon Linux 2022 : vim-common, vim-data, vim-default-editor (ALAS2022-2022-155)	Nessus	Amazon Linux Local Security Checks	critical
164318	GLSA-202208-32 : Vim, gVim: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
164292	macOS 11.x < 11.6.8 (HT213344)	Nessus	MacOS X Local Security Checks	critical
159106	macOS 12.x < 12.3 (HT213183)	Nessus	MacOS X Local Security Checks	critical
158211	Amazon Linux 2 : vim (ALAS-2022-1751)	Nessus	Amazon Linux Local Security Checks	critical
158195	Amazon Linux AMI : vim (ALAS-2022-1567)	Nessus	Amazon Linux Local Security Checks	critical

Detections

Analytics

CVE-2022-0158

low

Tenable Plugins

high

high

high

high

critical

critical

critical

critical

critical

critical

critical