The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5458-1 advisory.

    It was discovered that Vim was incorrectly handling virtual column position operations, which could result     in an out-of-bounds read. An attacker could possibly use this issue to expose sensitive information.
    (CVE-2021-4193)

    It was discovered that Vim was not properly performing bounds checks when updating windows present on a     screen, which could result in a heap buffer overflow. An attacker could possibly use this issue to cause a     denial of service or execute arbitrary code. (CVE-2022-0213)

    It was discovered that Vim was incorrectly handling window exchanging operations when in Visual mode,     which could result in an out-of-bounds read. An attacker could possibly use this issue to expose sensitive     information. (CVE-2022-0319)

    It was discovered that Vim was incorrectly handling recursion when parsing conditional expressions. An     attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
    (CVE-2022-0351)

    It was discovered that Vim was not properly handling memory allocation when processing data in Ex mode,     which could result in a heap buffer overflow. An attacker could possibly use this issue to cause a denial     of service or execute arbitrary code. (CVE-2022-0359)

    It was discovered that Vim was not properly performing bounds checks when executing line operations in     Visual mode, which could result in a heap buffer overflow. An attacker could possibly use this issue to     cause a denial of service or execute arbitrary code. (CVE-2022-0361, CVE-2022-0368)

    It was discovered that Vim was not properly handling loop conditions when looking for spell suggestions,     which could result in a stack buffer overflow. An attacker could possibly use this issue to cause a denial     of service or execute arbitrary code. (CVE-2022-0408)

    It was discovered that Vim was incorrectly handling memory access when executing buffer operations, which     could result in the usage of freed memory. An attacker could possibly use this issue to execute arbitrary     code. (CVE-2022-0443)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 16.04 ESM : Vim vulnerabilities (USN-5458-1)

high Nessus Plugin ID 161790

Version 1.5