PT-2022-2753 · Vim+9 · Vim+9

Brammool · Published 2022-04-14 · Updated 2024-06-15 · CVE-2022-1420

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Vim versions prior to 8.2.4774

Description The issue is related to an out-of-range pointer offset, which can be exploited by an attacker to cause a denial of service using a specially crafted file. This can happen when a user is tricked into opening a malicious file, leading to the application's crash. The estimated number of potentially affected devices and real-world incidents are not specified.

Recommendations For versions prior to 8.2.4774, update to version 8.2.4774 or later to resolve the issue. As a temporary workaround, consider avoiding the use of files from untrusted sources to minimize the risk of exploitation.

Exploit

Fix

Out of bounds Read

Buffer Overflow

Weakness Enumeration

CWE-125

CWE-823

CWE-119

Related Identifiers

ALSA-2022:5242

ALT-PU-2022-1716

ALT-PU-2022-1731

ALT-PU-2022-1771

ALT-PU-2022-1874

AZL-9531

BDU:2022-03270

CVE-2022-1420

MGASA-2022-0203

OPENSUSE-SU-2022_2102-1

OPENSUSE-SU-2024:12337-1

RHSA-2022:5242

RHSA-2022_5242

SUSE-SU-2022:2102-1

SUSE-SU-2022:4619-1

USN-5613-1

USN-5613-2

Affected Products

Alt Linux

Almalinux

Debian

Linuxmint

Apple Macos

Red Hat

Red Os

Suse

Ubuntu

Vim

References · 317

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1420.json · Exploit
• 🔥 https://huntr.dev/bounties/a4323ef8-90ea-4e1c-90e9-c778f0ecf326 · Exploit
• https://github.com/vim/vim/commit/8b91e71441069b1dde9ac9ff9d9a829b1b4aecca · Patch
• https://osv.dev/vulnerability/CVE-2022-1420 · Vendor Advisory
• https://debian.org/lts/security/2022/dla-3011 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/C3R36VSLO4TRX72SWB6IDJOD24BQXPX2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/QKIX5HYKWXWG6QBCPPTPQ53GNOFHSAIS · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2022:5242 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KVPZVE2CIE2NGCHZDMEHPBWN3LK2UQAA · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/HIP7KG7TVS5YF3QREAY2GOGUT3YUBZAI · Vendor Advisory
• https://security.gentoo.org/glsa/202208-32 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/X6E457NYOIRWBJHKB7ON44UY5AVTG4HU · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/7JBXG3MU6EZWJGJD6UTHHONHGJBYPQQT · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4619-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0943 · Vendor Advisory