Debian Long Term Support / LTS Security Information / 2022 / Security Information -- DLA-3204-1 vim

Debian Security Advisory

DLA-3204-1 vim -- LTS security update

Date Reported:

24 Nov 2022

Affected Packages:

vim

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2022-0318, CVE-2022-0392, CVE-2022-0629, CVE-2022-0696, CVE-2022-1619, CVE-2022-1621, CVE-2022-1785, CVE-2022-1897, CVE-2022-1942, CVE-2022-2000, CVE-2022-2129, CVE-2022-3235, CVE-2022-3256, CVE-2022-3352.

More information:

This update fixes multiple memory access violations in vim.

• CVE-2022-0318

  Heap-based Buffer Overflow

• CVE-2022-0392

  Heap-based Buffer Overflow

• CVE-2022-0629

  Stack-based Buffer Overflow

• CVE-2022-0696

  NULL Pointer Dereference

• CVE-2022-1619

  Heap-based Buffer Overflow in function cmdline_erase_chars. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution

• CVE-2022-1621

  Heap buffer overflow in vim_strncpy find_word. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution

• CVE-2022-1785

  Out-of-bounds Write

• CVE-2022-1897

  Out-of-bounds Write

• CVE-2022-1942

  Heap-based Buffer Overflow

• CVE-2022-2000

  Out-of-bounds Write

• CVE-2022-2129

  Out-of-bounds Write

• CVE-2022-3235

  Use After Free

• CVE-2022-3256

  Use After Free

• CVE-2022-3352

  Use After Free

For Debian 10 buster, these problems have been fixed in version 2:8.1.0875-5+deb10u4.

We recommend that you upgrade your vim packages.

For the detailed security status of vim please refer to its security tracker page at: https://security-tracker.debian.org/tracker/vim

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS