PT-2021-4713 · Vim+9 · Vim+9

Published 2021-09-11 · Updated 2023-01-11 · CVE-2021-3796

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions vim (affected versions not specified)

Description The issue is related to a Use After Free vulnerability in the vim text editor, specifically concerning the nv replace() function. This vulnerability allows an attacker to potentially execute arbitrary code or cause a denial of service by using a specially crafted file. The estimated number of potentially affected devices worldwide is not available.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Heap Based Buffer Overflow

Use After Free

Weakness Enumeration

CWE-122

CWE-416

Related Identifiers

ALSA-2021:4517

ALT-PU-2022-1087

ALT-PU-2022-1711

ALT-PU-2022-1731

ALT-PU-2022-1771

BDU:2021-05417

CESA-2021_4517

CVE-2021-3796

DLA-2876-1

MGASA-2021-0481

OESA-2021-1356

OPENSUSE-SU-2022:0736-1

OPENSUSE-SU-2022_0736-1

OPENSUSE-SU-2022_2102-1

RHSA-2021:4517

RHSA-2021_4517

RLSA-2021:4517

SUSE-SU-2022:0736-1

SUSE-SU-2022:0736-2

SUSE-SU-2022:2102-1

SUSE-SU-2022:4619-1

USN-5093-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

Vim

References · 275

• 🔥 https://huntr.dev/bounties/ab60b7f3-6fb1-4ac2-a4fa-4d592e08008d · Exploit
• https://github.com/vim/vim/commit/35a9a00afcb20897d462a766793ff45534810dc3 · Patch
• https://osv.dev/vulnerability/OESA-2021-1356 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TE62UMYBZE4AE53K6OBBWK32XQ7544QM · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3778 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0736-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-4517.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:0736-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3796 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S42L4Z4DTW4LHLQ4FJ33VEOXRCBE7WN4 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/TE62UMYBZE4AE53K6OBBWK32XQ7544QM · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/TE62UMYBZE4AE53K6OBBWK32XQ7544QM · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:4517 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5093-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2021-3796 · Vendor Advisory