PT-2022-4858 · Vim+7 · Vim+7

Abdulrahman Alqabandi + 3 · Published 2022-05-25 · Updated 2024-06-15 · CVE-2022-1898

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Vim versions prior to 8.2

Description The issue is related to a Use After Free vulnerability in the Vim text editor, specifically with the find pattern in path function. This vulnerability allows a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For versions prior to 8.2, update to version 8.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the find pattern in path function until a patch is available.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2022-2001

ALT-PU-2022-2019

ALT-PU-2022-2420

ALT-PU-2022-2430

AZL-9832

BDU:2022-05981

CVE-2022-1898

DLA-3053-1

DLA-3182-1

MGASA-2022-0223

OESA-2022-1717

OPENSUSE-SU-2022_2102-1

OPENSUSE-SU-2024:12337-1

SUSE-SU-2022:2102-1

SUSE-SU-2022:4619-1

USN-5498-1

USN-5995-1

Affected Products

Alt Linux

Astra Linux

Debian

Linuxmint

Apple Macos

Suse

Ubuntu

Vim

References · 324

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1898.json · Exploit
• 🔥 https://huntr.dev/bounties/45aad635-c2f1-47ca-a4f9-db5b25979cea · Exploit
• https://github.com/vim/vim/commit/e2fa213cf571041dbd04ab0329303ffdc980678a · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TYNK6SDCMOLQJOI3B4AOE66P2G2IH4ZM · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2946 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2206 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0223 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-1851 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-1735 · Vendor Advisory
• https://security.gentoo.org/glsa/202208-32 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4619-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2571 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-1629 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1898 · Security Note
• https://ubuntu.com/security/CVE-2022-2849 · Vendor Advisory