PT-2022-3447 · Vim+7 · Vim+7

Brammool · Published 2022-05-31 · Updated 2025-03-30 · CVE-2022-1942

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vim versions prior to 8.2

Description The issue is related to a heap-based buffer overflow in the Vim text editor, specifically in the vim regsub both() function, which can be exploited by a remote attacker to execute arbitrary code. This overflow occurs in the dynamic memory, potentially allowing for code execution. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For versions prior to 8.2, update to version 8.2 or later to resolve the issue. As a temporary workaround, consider disabling the vim regsub both() function until a patch is available.

Exploit

Fix

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

ALT-PU-2022-2001

ALT-PU-2022-2019

ALT-PU-2022-2420

ALT-PU-2022-2430

BDU:2022-04225

CVE-2022-1942

DLA-3204-1

DLA-4097-1

MGASA-2022-0223

OESA-2022-1717

OPENSUSE-SU-2024:12337-1

USN-5507-1

USN-5995-1

Affected Products

Alt Linux

Astra Linux

Debian

Linuxmint

Apple Macos

Red Os

Ubuntu

Vim

References · 168

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1942.json · Exploit
• 🔥 https://huntr.dev/bounties/67ca4d3b-9175-43c1-925c-72a7091bc071 · Exploit
• https://github.com/vim/vim/commit/71223e2db87c2bf3b09aecb46266b56cda26191d · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TYNK6SDCMOLQJOI3B4AOE66P2G2IH4ZM · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2946 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2845 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2206 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0223 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-1942 · Security Note
• https://ubuntu.com/security/CVE-2022-1851 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0223.html · Security Note
• https://ubuntu.com/security/CVE-2022-1735 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04225 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-1942 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-1968 · Security Note