PT-2022-4979 · Vim+7 · Vim+7

Brammool · Published 2022-08-28 · Updated 2023-10-09 · CVE-2022-3278

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.0.0552

Description The issue is related to a null pointer dereference error when handling the eval1 frame in the Vim text editor. This could potentially allow a remote attacker to cause a denial of service.

Recommendations For versions prior to 9.0.0552, update to version 9.0.0552 or later to resolve the issue.

Exploit

Fix

NULL Pointer Dereference

Buffer Overflow

Memory Corruption

Use After Free

Stack Overflow

Weakness Enumeration

CWE-476

CWE-119

CWE-787

CWE-416

CWE-121

Related Identifiers

ALT-PU-2022-2828

ALT-PU-2022-2911

ALT-PU-2022-2914

ALT-PU-2022-3192

AZL-11018

BDU:2022-06177

BDU:2022-06178

BDU:2022-06179

BDU:2022-06180

CVE-2022-3278

MGASA-2022-0430

OPENSUSE-SU-2022_4282-1

SUSE-SU-2022:4282-1

SUSE-SU-2022:4619-1

USN-6420-1

Affected Products

Alt Linux

Astra Linux

Debian

Linuxmint

Red Os

Suse

Ubuntu

Vim

References · 290

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3278.json · Exploit
• 🔥 https://huntr.dev/bounties/a9fad77e-f245-4ce9-ba15-c7d4c86c4612 · Exploit
• https://github.com/vim/vim/commit/69082916c8b5d321545d60b9f5facad0a2dd5a4e · Patch
• https://osv.dev/vulnerability/MGASA-2022-0430 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06179 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0316SE47MD · Vendor Advisory
• https://debian.org/lts/security/2022/dla-3182 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/4JJNUS4AEVYSEJMCK6JZB57QHD5V2G4O · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6420-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3591 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3278 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3235 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-3297 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4619-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI · Vendor Advisory