PT-2022-5349 · Vim+8 · Vim+8

Brammool · Published 2022-10-26 · Updated 2023-10-09 · CVE-2022-3705

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions vim versions prior to 9.0.0805

Description A vulnerability was found in the function qf update buffer of the file quickfix.c of the component autocmd Handler, which leads to use after free. The attack may be launched remotely, potentially affecting the confidentiality, integrity, and availability of protected information.

Recommendations To address this issue, upgrade to version 9.0.0805 or later. As a temporary workaround, consider disabling the qf update buffer function until a patch is available. Restrict access to the affected component to minimize the risk of exploitation.

Fix

Use After Free

Buffer Overflow

Weakness Enumeration

CWE-416

CWE-119

Related Identifiers

ALT-PU-2022-2980

ALT-PU-2022-3057

ALT-PU-2022-3165

ALT-PU-2022-3192

AZL-11358

BDU:2022-06663

CVE-2022-3705

DLA-3182-1

MGASA-2022-0430

OESA-2022-2043

OPENSUSE-SU-2022_4282-1

OPENSUSE-SU-2022_4631-1

SUSE-SU-2022:4282-1

SUSE-SU-2022:4619-1

SUSE-SU-2022:4631-1

SUSE-SU-2023:0209-1

USN-6420-1

Affected Products

Alt Linux

Astra Linux

Debian

Linuxmint

Apple Macos

Red Os

Suse

Ubuntu

Vim

References · 309

• https://github.com/vim/vim/commit/d0fab10ed2a86698937e3c3fed2f10bd9bb5e731 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2022:4631-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3705 · Security Note
• https://ubuntu.com/security/CVE-2022-3324 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0316SE47MD · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3235 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3256 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/4JCW33NOLMELTTTDJH7WGDIFJZ5YEEMK · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3297 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3234 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3520 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-3705 · Security Note
• https://ubuntu.com/security/CVE-2022-3591 · Vendor Advisory