PT-2023-1226 · Vim+9 · Vim+9

Brammool · Published 2022-09-15 · Updated 2023-08-31 · CVE-2022-47024

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vim versions 8.1.2269 through 9.0.0339

Description A null pointer dereference issue was discovered in the gui x11 create blank mouse function in gui x11.c, allowing attackers to cause denial of service or other unspecified impacts. This issue can be exploited using a specially crafted file.

Recommendations For versions 8.1.2269 through 9.0.0339, consider disabling the gui x11 create blank mouse function as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALSA-2023:0958

ALT-PU-2022-2616

ALT-PU-2022-2704

ALT-PU-2022-2714

ALT-PU-2022-3192

BDU:2023-00450

CVE-2022-47024

MGASA-2023-0075

OESA-2023-1061

RHSA-2023:0958

RHSA-2023_0958

RLSA-2023:0958

USN-5836-1

USN-5963-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Debian

Linuxmint

Red Hat

Red Os

Rocky Linux

Ubuntu

Vim

References · 54

• https://github.com/vim/vim/commit/a63ad78ed31e36dbdf3a9cd28071dcdbefce7d19 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2022-47024 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-0054 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5836-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-1264 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5963-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202305-16 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-0958.html · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1061 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47024 · Security Note
• https://linux.oracle.com/errata/ELSA-2023-0958.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-0049 · Vendor Advisory
• https://goslinux.fssp.gov.ru/2726972 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0316SE47MD · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-47024 · Vendor Advisory