SB2022082701 - Multiple vulnerabilities in Vim

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Use-after-free (CVE-ID: CVE-2022-2982)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the qf_fill_buffer() function in quickfix.c. A remote attacker can trick the victim to open a specially crafted file, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

2) NULL pointer dereference (CVE-ID: CVE-2022-2980)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the do_mouse() function in mouse.c. A remote attacker can perform a denial of service (DoS) attack.

3) NULL pointer dereference (CVE-ID: CVE-2022-2923)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the sug_filltree() function in spellfile.c. A remote attacker can perform a denial of service (DoS) attack.

4) Use-after-free (CVE-ID: CVE-2022-2946)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the vim_vsnprintf_typval() function in strings.c. A remote attacker can trick the victim to open a specially crafted file, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Remediation

Install update from vendor's website.

References

• https://github.com/vim/vim/commit/d6c67629ed05aae436164eec474832daf8ba7420
• https://huntr.dev/bounties/53f53d9a-ba8a-4985-b7ba-23efbe6833be
• https://github.com/vim/vim/commit/80525751c5ce9ed82c41d83faf9ef38667bf61b1
• https://huntr.dev/bounties/6e7b12a5-242c-453d-b39e-9625d563b0ea
• https://huntr.dev/bounties/fd3a3ab8-ab0f-452f-afea-8c613e283fd2
• https://github.com/vim/vim/commit/6669de1b235843968e88844ca6d3c8dec4b01a9e
• https://huntr.dev/bounties/5d389a18-5026-47df-a5d0-1548a9b555d5
• https://github.com/vim/vim/commit/adce965162dd89bf29ee0e5baf53652e7515762c