PT-2022-1740 · Vim+10 · Vim+10

Brammool · Published 2022-01-30 · Updated 2024-06-15 · CVE-2022-0413

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vim versions prior to 8.2

Description The issue is related to a use after free error in the src/ex cmds.c component of the vim text editor, which involves the use of memory after it has been freed. This could allow an attacker to execute arbitrary code.

Recommendations For versions prior to 8.2, update to version 8.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the src/ex cmds.c component until a patch is available.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2022:0894

ALT-PU-2022-1693

ALT-PU-2022-1711

ALT-PU-2022-1731

ALT-PU-2022-1771

AZL-8460

BDU:2022-01016

CESA-2022_0894

CVE-2022-0413

DLA-3011-1

DLA-3182-1

MGASA-2022-0203

OESA-2022-1514

OPENSUSE-SU-2022:0736-1

OPENSUSE-SU-2022_0736-1

OPENSUSE-SU-2022_2102-1

OPENSUSE-SU-2024:12337-1

RHSA-2022:0894

RHSA-2022_0894

RLSA-2022:0894

SUSE-SU-2022:0736-1

SUSE-SU-2022:0736-2

SUSE-SU-2022:2102-1

SUSE-SU-2022:4619-1

USN-5498-1

USN-5995-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Debian

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

Vim

References · 359

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0413.json · Exploit
• 🔥 https://huntr.dev/bounties/563d1e8f-5c3d-4669-941c-3216f4a87c38 · Exploit
• https://github.com/vim/vim/commit/37f47958b8a2a44abc60614271d9537e7f14e51a · Patch
• https://ubuntu.com/security/CVE-2022-2923 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/C3R36VSLO4TRX72SWB6IDJOD24BQXPX2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/UCWG5L6CRQWACGVP7CYGESUB3G6QJ3GS · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2129 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-0894.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12337-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2946 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2183 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2022:0894 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0368 · Security Note
• https://ubuntu.com/security/CVE-2022-1785 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01016 · Security Note