PT-2022-4247 · Vim+6 · Vim+6

Brammool · Published 2022-08-17 · Updated 2024-06-15 · CVE-2022-2849

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.0.0220

Description The issue is related to a heap-based buffer overflow in the Vim text editor, specifically in the latin ptr2len() function, which can lead to exploitation allowing an attacker to impact the confidentiality, integrity, and availability of protected information. The estimated number of potentially affected devices worldwide is not specified. Details about real-world incidents where this issue was exploited are not provided.

Recommendations For versions prior to 9.0.0220, update to version 9.0.0220 or later to resolve the issue. As a temporary workaround, consider restricting the use of the latin ptr2len() function until a patch is available.

Exploit

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

ALT-PU-2022-2616

ALT-PU-2022-2704

ALT-PU-2022-2714

ALT-PU-2022-3192

AZL-10570

BDU:2022-05097

CVE-2022-2849

MGASA-2022-0430

OPENSUSE-SU-2022_3229-1

OPENSUSE-SU-2024:12337-1

SUSE-SU-2022:3229-1

SUSE-SU-2022:4619-1

USN-5995-1

Affected Products

Alt Linux

Astra Linux

Debian

Linuxmint

Suse

Ubuntu

Vim

References · 306

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2849.json · Exploit
• 🔥 https://huntr.dev/bounties/389aeccd-deb9-49ae-9b6a-24c12d79b02e · Exploit
• https://github.com/vim/vim/commit/f6d39c31d2177549a986d170e192d8351bd571e2 · Patch
• https://ubuntu.com/security/CVE-2022-2946 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2206 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0430 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2849 · Security Note
• https://ubuntu.com/security/CVE-2022-1851 · Vendor Advisory
• https://debian.org/lts/security/2022/dla-3182 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-1735 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-10570 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4619-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2571 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-1629 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2849 · Vendor Advisory