Re: 3 new CVE's in vim

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
Re: 3 new CVE's in vim

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Alan Coopersmith &lt;alan.coopersmith () oracle com&gt;

Date: Fri, 14 Jan 2022 19:22:11 -0800

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
On 10/4/21 08:48, Alan Coopersmith wrote:
On 9/30/2021 7:39 PM, Alan Coopersmith wrote:
I haven't seen these make it to the list yet, but three CVE's were
recently assigned for bugs in vim.&nbsp; [I personally don't see how
there's a security boundary crossed in normal vim usage here, but
could see issues if someone had configured vim to run with raised
privileges for editing system/application configuration files or
similar.]

I do note all three of these were submitted via huntr.dev, which offers
bounties for both reporting &amp; fixing security bugs.&nbsp; As a maintainer of
an upstream open source project which is struggling with finding people
to fix reported security bugs [1], I do appreciate the additional
incentive to provide fixes here.&nbsp; But as a maintainer of a distro, I see
a mismatch with the incentives here, as you get bounties for accepting
everything as a security bug and not pushing back, and flooding the
distros with CVE's - even if your distro policy isn't to handle every
CVE that applies, security auditors will often make your users query
about every CVE that they think applies, costing your time to respond.

[1] https://indico.freedesktop.org/event/1/contributions/28/
https://www.youtube.com/watch?v=IU3NeVvDSp0

This has continued with many more CVE's issued for vim:

CVE-2022-0213   vim is vulnerable to Heap-based Buffer Overflow
CVE-2022-0158   vim is vulnerable to Heap-based Buffer Overflow
CVE-2022-0156   vim is vulnerable to Use After Free
CVE-2022-0128   vim is vulnerable to Out-of-bounds Read
CVE-2021-46059 	A Pointer Dereference vulnerability exists in Vim 8.2.3883 via 
the vim_regexec_multi function at regexp.c, which causes a denial of service.
CVE-2021-4193   vim is vulnerable to Out-of-bounds Read
CVE-2021-4192   vim is vulnerable to Use After Free
CVE-2021-4187   vim is vulnerable to Use After Free
CVE-2021-4173   vim is vulnerable to Use After Free
CVE-2021-4166   vim is vulnerable to Out-of-bounds Read
CVE-2021-4136   vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-4069   vim is vulnerable to Use After Free
CVE-2021-4019   vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3984   vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3974   vim is vulnerable to Use After Free
CVE-2021-3973   vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3968   vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3928   vim is vulnerable to Use of Uninitialized Variable
CVE-2021-3927   vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3903   vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3875   vim is vulnerable to Heap-based Buffer Overflow

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

Re: 3 new CVE's in vim Alan Coopersmith (Jan 15)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->