PT-2022-1738 · Vim+6 · Vim+6

Brammool · Published 2022-02-13 · Updated 2025-03-30 · CVE-2022-0572

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vim versions prior to 8.2

Description The issue is related to a heap-based buffer overflow in the vim text editor. This overflow is caused by the ex retab() function in the indent.c file. Exploitation of this issue may allow an attacker to execute arbitrary code.

Recommendations For versions prior to 8.2, update to version 8.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ex retab() function until a patch is available.

Exploit

Fix

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

ALT-PU-2022-1693

ALT-PU-2022-1711

ALT-PU-2022-1731

ALT-PU-2022-1771

AZL-8585

BDU:2022-01014

CVE-2022-0572

DLA-3011-1

DLA-3182-1

DLA-4097-1

MGASA-2022-0203

OESA-2022-1555

OPENSUSE-SU-2024:12337-1

USN-5460-1

USN-6026-1

Affected Products

Alt Linux

Astra Linux

Debian

Linuxmint

Apple Macos

Ubuntu

Vim

References · 178

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0572.json · Exploit
• 🔥 https://huntr.dev/bounties/bf3e0643-03e9-4436-a1c8-74e7111c32bf · Exploit
• https://github.com/vim/vim/commit/6e28703a8e41f775f64e442c5d11ce1ff599aa3f · Patch
• https://safe-surf.ru/specialists/bulletins-nkcki/691833 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0572 · Vendor Advisory
• https://lists.fedoraproject.org/archives/search?mlist=package-announce%40lists.fedoraproject.org&q=CVE-2022-0572 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-8585 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-1619 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1555 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0261 · Vendor Advisory
• https://debian.org/lts/security/2022/dla-3011 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/C3R36VSLO4TRX72SWB6IDJOD24BQXPX2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/QKIX5HYKWXWG6QBCPPTPQ53GNOFHSAIS · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GOY5YWTP5QUY2EFLCL7AUWA2CV57C37 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/HIP7KG7TVS5YF3QREAY2GOGUT3YUBZAI · Vendor Advisory