Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2023.2243
USN-6026-1: Vim vulnerabilities
20 April 2023
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Vim
Publisher: Ubuntu
Operating System: Ubuntu
Resolution: Patch/Upgrade
CVE Names: CVE-2022-2207 CVE-2022-0729 CVE-2022-0714
CVE-2022-0685 CVE-2022-0629 CVE-2022-0572
CVE-2022-0554 CVE-2022-0443 CVE-2022-0408
CVE-2022-0368 CVE-2022-0361 CVE-2022-0359
CVE-2022-0351 CVE-2022-0319 CVE-2022-0318
CVE-2022-0261 CVE-2022-0213 CVE-2021-4193
CVE-2021-4192 CVE-2021-4166
Original Bulletin:
https://ubuntu.com/security/notices/USN-6026-1
Comment: CVSS (Max): 9.8 CVE-2022-0318 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS Source: NVD
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- --------------------------BEGIN INCLUDED TEXT--------------------
USN-6026-1: Vim vulnerabilities
19 April 2023
Several security issues were fixed in Vim.
Releases
o Ubuntu 22.04 LTS
o Ubuntu 20.04 LTS
o Ubuntu 18.04 LTS
o Ubuntu 14.04 ESM
Packages
o vim - Vi IMproved - enhanced vi editor
Details
It was discovered that Vim was incorrectly processing Vim buffers. An
attacker could possibly use this issue to perform illegal memory access and
expose sensitive information. This issue only affected Ubuntu 20.04 LTS.
( CVE-2021-4166 )
It was discovered that Vim was using freed memory when dealing with regular
expressions inside a visual selection. If a user were tricked into opening a
specially crafted file, an attacker could crash the application, leading to a
denial of service, or possibly achieve code execution with user privileges.
This issue only affected Ubuntu 14.04 ESM, Ubuntu 18.04 LTS and Ubuntu
20.04 LTS. ( CVE-2021-4192 )
It was discovered that Vim was incorrectly handling virtual column position
operations, which could result in an out-of-bounds read. An attacker could
possibly use this issue to expose sensitive information. This issue only
affected Ubuntu 14.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
( CVE-2021-4193 )
It was discovered that Vim was not properly performing bounds checks when
updating windows present on a screen, which could result in a heap buffer
overflow. An attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. ( CVE-2022-0213 )
It was discovered that Vim was incorrectly performing read and write
operations when in visual block mode, going beyond the end of a line and
causing a heap buffer overflow. If a user were tricked into opening a
specially crafted file, an attacker could crash the application, leading to a
denial of service, or possibly achieve code execution with user privileges.
This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu
22.04 LTS. ( CVE-2022-0261 , CVE-2022-0318 )
It was discovered that Vim was incorrectly handling window exchanging
operations when in Visual mode, which could result in an out-of-bounds read.
An attacker could possibly use this issue to expose sensitive information.
( CVE-2022-0319 )
It was discovered that Vim was incorrectly handling recursion when parsing
conditional expressions. An attacker could possibly use this issue to cause
a denial of service or execute arbitrary code. ( CVE-2022-0351 )
It was discovered that Vim was not properly handling memory allocation when
processing data in Ex mode, which could result in a heap buffer overflow.
An attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. ( CVE-2022-0359 )
It was discovered that Vim was not properly performing bounds checks when
executing line operations in Visual mode, which could result in a heap
buffer overflow. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. This issue only affected
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. ( CVE-2022-0361 ,
CVE-2022-0368 )
It was discovered that Vim was not properly handling loop conditions when
looking for spell suggestions, which could result in a stack buffer
overflow. An attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. ( CVE-2022-0408 )
It was discovered that Vim was incorrectly handling memory access when
executing buffer operations, which could result in the usage of freed
memory. An attacker could possibly use this issue to execute arbitrary
code. ( CVE-2022-0443 )
It was discovered that Vim was incorrectly processing Vim buffers. An
attacker could possibly use this issue to perform illegal memory access and
expose sensitive information. ( CVE-2022-0554 )
It was discovered that Vim was not properly performing bounds checks for
column numbers when replacing tabs with spaces or spaces with tabs, which
could cause a heap buffer overflow. An attacker could possibly use this
issue to cause a denial of service or execute arbitrary code.
( CVE-2022-0572 )
It was discovered that Vim was incorrectly processing Vim buffers. An
attacker could possibly use this issue to perform illegal memory access and
expose sensitive information. This issue only affected Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. ( CVE-2022-0629 )
It was discovered that Vim was not properly performing validation of data
that contained special multi-byte characters, which could cause an
out-of-bounds read. An attacker could possibly use this issue to cause a
denial of service. ( CVE-2022-0685 )
It was discovered that Vim was incorrectly processing data used to define
indentation in a file, which could cause a heap buffer overflow. An
attacker could possibly use this issue to cause a denial of service.
( CVE-2022-0714 )
It was discovered that Vim was incorrectly processing certain regular
expression patterns and strings, which could cause an out-of-bounds read.
An attacker could possibly use this issue to cause a denial of service.
( CVE-2022-0729 )
It was discovered that Vim incorrectly handled memory access. An attacker
could potentially use this issue to cause the corruption of sensitive
information, a crash, or arbitrary code execution. ( CVE-2022-2207 )
Update instructions
The problem can be corrected by updating your system to the following package
versions:
Ubuntu 22.04
o vim - 2:8.2.3995-1ubuntu2.7
Ubuntu 20.04
o vim - 2:8.1.2269-1ubuntu5.14
Ubuntu 18.04
o vim - 2:8.0.1453-1ubuntu1.13
Ubuntu 14.04
o vim - 2:7.4.052-1ubuntu3.1+esm9
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References
o CVE-2022-0729
o CVE-2022-2207
o CVE-2022-0714
o CVE-2022-0408
o CVE-2022-0572
o CVE-2022-0685
o CVE-2022-0261
o CVE-2022-0351
o CVE-2022-0359
o CVE-2021-4166
o CVE-2022-0319
o CVE-2022-0213
o CVE-2022-0443
o CVE-2021-4193
o CVE-2022-0368
o CVE-2022-0554
o CVE-2022-0361
o CVE-2022-0318
o CVE-2021-4192
o CVE-2022-0629
Related notices
o USN-5460-1 : vim-athena, vim-gtk, vim-common, vim-gnome, vim-gnome-py2,
vim-gtk3, vim-athena-py2, vim-doc, vim-nox, vim-nox-py2, vim-gui-common,
vim-tiny, vim-gtk3-py2, vim, vim-gtk-py2, vim-runtime
o USN-5516-1 : vim-athena, vim-gtk, vim-common, vim-gnome, vim-gnome-py2,
vim-gtk3, vim-athena-py2, vim-doc, vim-nox, vim-nox-py2, vim-gui-common,
vim-tiny, vim-gtk3-py2, vim, vim-gtk-py2, vim-runtime
o USN-5458-1 : vim-athena, vim-gtk, vim-common, vim-gnome, vim-gnome-py2,
vim-gtk3, vim-athena-py2, vim-doc, vim-nox, vim-nox-py2, vim-gui-common,
vim-tiny, vim-gtk3-py2, vim, vim-gtk-py2, vim-runtime
o USN-5433-1 : vim-athena, vim-gtk, vim-common, vim-gnome, vim-gnome-py2,
vim-gtk3, vim-athena-py2, vim-doc, vim-nox, vim-nox-py2, vim-gui-common,
vim-tiny, vim-gtk3-py2, vim, vim-gtk-py2, vim-runtime
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBZECXaskNZI30y1K9AQimoA//SvQEYNx0l4NKyXenFSqwhzGcmyaZSzCp
zbpukEyi/tGSwkh9evu79mTbzceoQ3dZiqYHp91FGkRyBUNBt5lOgtn8wH647Cvb
UPkqcPF+MlqHpqaaNARRkDOAE8snXr1zGO/eKza4QJlkPa9FwU9dVrg9urTNzvHF
+AG0l+6lullAj9n+El3qqy62LdqsX2AAuZClSuRljNtSSoZMhSJNKXeldlchCz//
S6jvS9V5b65yjTT8+b2IT5AHS+r3wUPtk4GY3w7/lCziQNcgpLJIm3FMmYEve1nO
xVBl+XlRE/qnlK8rr901D2+/JwkV4f+vcPr362nuBFGb/QxqpD6JUcknI+DKpQ79
6FTZigA2QtTeAEg44WuMO1jLPcy9XrCxkBOfT5Z1hz0POg+6PohdumSRVP1c3QXH
85i+cYMtlhE2LTaCTN1zkMVYqzq707bKmdPGL4tPF9cxnMNcakjCa3Qzx3dOmSO6
CYs+14BSf5upEiq0j7ZbIUzTWgES94SIgWMdc4G6MNnK/FCIB2504DU+HYJqmRuT
/mq+vFkNg4uFdr7dk0KQDNNzuqsnj6cQH7DnwQHzHNa+SOtj4gQMgkVCQOIW1/cj
uO15F7WmjZ6ili3LFDCFVHaYGY1wbQ9aERvPxLSxnHQbzdefqKtvRs+lt6Yj/zdB
Kvx+aLa5TIE=
=aJ39
-----END PGP SIGNATURE-----