Ubuntu update for vim
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 9 |
| CVE-ID | CVE-2022-1674 CVE-2022-1725 CVE-2022-2124 CVE-2022-2125 CVE-2022-2126 CVE-2022-2175 CVE-2022-2183 CVE-2022-2206 CVE-2022-2304 |
| CWE-ID | CWE-476 CWE-125 CWE-122 CWE-121 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Ubuntu Operating systems & Components / Operating system vim-nox (Ubuntu package) Operating systems & Components / Operating system package or component vim-gtk3 (Ubuntu package) Operating systems & Components / Operating system package or component vim-gnome-py2 (Ubuntu package) Operating systems & Components / Operating system package or component vim-tiny (Ubuntu package) Operating systems & Components / Operating system package or component vim-gtk-py2 (Ubuntu package) Operating systems & Components / Operating system package or component vim-gtk3-py2 (Ubuntu package) Operating systems & Components / Operating system package or component vim (Ubuntu package) Operating systems & Components / Operating system package or component vim-gtk (Ubuntu package) Operating systems & Components / Operating system package or component vim-athena (Ubuntu package) Operating systems & Components / Operating system package or component vim-athena-py2 (Ubuntu package) Operating systems & Components / Operating system package or component vim-gnome (Ubuntu package) Operating systems & Components / Operating system package or component vim-nox-py2 (Ubuntu package) Operating systems & Components / Operating system package or component |
| Vendor | Canonical Ltd. |
Security Bulletin
This security bulletin contains information about 9 vulnerabilities.
1) NULL pointer dereference
EUVDB-ID: #VU63491
Risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-1674
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trick the victim to open a specially crafted file and perform a denial of service attack.
MitigationUpdate the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 16.04
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gnome-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gnome (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:ubuntu:16.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gnome-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gnome_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-5723-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) NULL pointer dereference
EUVDB-ID: #VU66151
Risk: Medium
CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-1725
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trick the victim to open a specially crafted file and perform a denial of service (DoS) attack.
MitigationUpdate the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 16.04
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gnome-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gnome (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gnome-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gnome_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-5723-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Out-of-bounds read
EUVDB-ID: #VU64718
Risk: Low
CVSSv4.0: 0.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-2124
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in textobject.c. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.
MitigationUpdate the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 16.04
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gnome-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gnome (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gnome-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gnome_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-5723-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Heap-based buffer overflow
EUVDB-ID: #VU64717
Risk: Medium
CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-2125
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in indent.c. A remote attacker can trick the victim to open a specially crafted file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 16.04
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gnome-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gnome (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gnome-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gnome_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-5723-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Out-of-bounds read
EUVDB-ID: #VU64716
Risk: Low
CVSSv4.0: 0.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-2126
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in spellsuggest.c. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.
MitigationUpdate the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 16.04
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gnome-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gnome (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gnome-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gnome_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-5723-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Out-of-bounds read
EUVDB-ID: #VU64713
Risk: Low
CVSSv4.0: 0.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-2175
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in ex_getln.c. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.
MitigationUpdate the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 16.04
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gnome-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gnome (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gnome-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gnome_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-5723-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Out-of-bounds read
EUVDB-ID: #VU64711
Risk: Low
CVSSv4.0: 0.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-2183
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in indent.c. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.
MitigationUpdate the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 16.04
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gnome-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gnome (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gnome-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gnome_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-5723-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Out-of-bounds read
EUVDB-ID: #VU64710
Risk: Low
CVSSv4.0: 0.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-2206
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in term.c. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.
MitigationUpdate the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 16.04
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gnome-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gnome (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gnome-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gnome_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-5723-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Stack-based buffer overflow
EUVDB-ID: #VU65395
Risk: Low
CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-2304
CWE-ID:
CWE-121 - Stack-based buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in spell_dump_compl() function at spell.c:4038. A remote unauthenticated attacker can trick the victim into opening a specially crafted file to trigger stack-based buffer overflow and execute arbitrary code on the target system.
MitigationUpdate the affected package vim to the latest version.
Vulnerable software versionsUbuntu: 16.04
vim-nox (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gnome-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-tiny (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk3-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gtk (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-athena-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-gnome (Ubuntu package): before Ubuntu Pro (Infra-only)
vim-nox-py2 (Ubuntu package): before Ubuntu Pro (Infra-only)
CPE2.3- cpe:2.3:o:canonical:vim-nox_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gnome-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-tiny_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk3-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gtk_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-athena-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-gnome_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:o:canonical:vim-nox-py2_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-5723-1
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
