PT-2022-2735 · Vim+7 · Vim+7

Brammool · Published 2022-05-16 · Updated 2024-06-15 · CVE-2022-1771

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions vim versions prior to 8.2.4975

Description The issue is caused by uncontrolled recursion in the Vim text editor. Exploitation of this issue may allow an attacker to cause a denial of service. It is also related to a boundary error when processing certain input, which can lead to a stack-based buffer overflow, resulting in a denial of service attack.

Recommendations For versions prior to 8.2.4975, update to version 8.2.4975 or later to resolve the issue. At the moment, there is no information about additional mitigation measures for this vulnerability.

Exploit

Fix

Uncontrolled Recursion

Stack Overflow

Weakness Enumeration

CWE-674

CWE-121

Related Identifiers

ALT-PU-2022-1948

ALT-PU-2022-1958

ALT-PU-2022-1977

ALT-PU-2022-1987

AZL-9789

BDU:2022-03240

CVE-2022-1771

OESA-2022-1717

OPENSUSE-SU-2022_2102-1

OPENSUSE-SU-2024:12337-1

SUSE-SU-2022:2102-1

SUSE-SU-2022:4619-1

USN-6557-1

Affected Products

Alt Linux

Astra Linux

Debian

Linuxmint

Red Os

Suse

Ubuntu

Vim

References · 282

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1771.json · Exploit
• 🔥 https://huntr.dev/bounties/faa74175-5317-4b71-a363-dfc39094ecbb · Exploit
• https://github.com/vim/vim/commit/51f0bfb88a3554ca2dde777d78a59880d1ee37a8 · Patch
• https://ubuntu.com/security/CVE-2023-48235 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2000 · Vendor Advisory
• https://security.gentoo.org/glsa/202208-32 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-48236 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4619-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1898 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-1771 · Security Note
• https://security.gentoo.org/glsa/202305-16 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20221220SE16 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-9789 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-1771 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2042 · Vendor Advisory