Vulmon
Amazon Linux AMI Security Advisory: ALAS-2022-1639
Advisory Release Date: 2022-10-17 20:22 Pacific
Advisory Updated Date: 2022-10-20 20:35 Pacific
A flaw was found in vim, which is vulnerable to an out-of-bounds read in the msg_outtrans_special function. This flaw allows a specially crafted file to crash software or execute code when opened in vim. (CVE-2022-2257)
A heap buffer overflow vulnerability was found in Vim's inc() function of misc2.c. This issue occurs because Vim reads beyond the end of the line with a put command. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering an out-of-bounds read that causes a crash in the CLI tool. (CVE-2022-2264)
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. (CVE-2022-2284)
Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0. (CVE-2022-2285)
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. (CVE-2022-2286)
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. (CVE-2022-2287)
Out-of-bounds Write in GitHub repository vim/vim prior to 9.0. (CVE-2022-2288)
Use After Free in GitHub repository vim/vim prior to 9.0. (CVE-2022-2289)
A stack-based buffer overflow vulnerability was found in Vim's spell_dump_compl() function of the src/spell.c file. This issue occurs because the spell dump goes beyond the end of an array when crafted input is processed. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering an out-of-bounds write that causes an application to crash, possibly executing code and corrupting memory. (CVE-2022-2304)
A heap-based buffer overflow was found in Vim in the ins_compl_add function in the insexpand.c file. This issue occurs due to a read past the end of a buffer when a specially crafted input is processed. This flaw allows an attacker who can trick a user into opening a specially crafted file into triggering the heap-based buffer overflow, causing the application to crash, possibly executing code and corrupting memory. (CVE-2022-2343)
A heap-based buffer overflow was found in Vim in the ins_compl_add function in the insexpand.c file. This issue occurs due to a read past the end of a buffer when a specially crafted input is processed. This flaw allows an attacker who can trick a user into opening a specially crafted file into triggering the heap-based buffer overflow, causing the application to crash, possibly executing code and corrupting memory. (CVE-2022-2344)
A use-after-free vulnerability was found in Vim in the skipwhite function in the charset.c file. This issue occurs because an already freed memory is used when a specially crafted input is processed. This flaw allows an attacker who can trick a user into opening a specially crafted file into triggering the use-after-free, and cause the application to crash, possibly executing code and corrupting memory. (CVE-2022-2345)
An out-of-bounds read vulnerability was found in Vim in the check_vim9_unlet function in the vim9cmds.c file. This issue occurs because of invalid memory access when compiling the unlet command when a specially crafted input is processed. This flaw allows an attacker who can trick a user into opening a specially crafted file into triggering the out-of-bounds read, causing the application to crash, possibly executing code and corrupting memory. (CVE-2022-2816)
A use-after-free vulnerability was found in Vim in the string_quote function in the strings.c file. This issue occurs because an already freed memory is used when a specially crafted input is processed. This flaw allows an attacker who can trick a user into opening a specially crafted file into triggering the use-after-free, causing the application to crash, possibly executing code and corrupting memory. (CVE-2022-2817)
A flaw was found in vim. The vulnerability occurs due to illegal memory access and leads to a heap buffer overflow vulnerability. This flaw allows an attacker to input a specially crafted file, leading to a crash or code execution. (CVE-2022-2819)
Use After Free in GitHub repository vim/vim prior to 9.0.0322. (CVE-2022-3037)
Affected Packages:
vim
Issue Correction:
Run yum update vim to update your system.
i686:
vim-debuginfo-9.0.475-1.1.amzn1.i686
vim-common-9.0.475-1.1.amzn1.i686
vim-minimal-9.0.475-1.1.amzn1.i686
vim-enhanced-9.0.475-1.1.amzn1.i686
noarch:
vim-data-9.0.475-1.1.amzn1.noarch
vim-filesystem-9.0.475-1.1.amzn1.noarch
src:
vim-9.0.475-1.1.amzn1.src
x86_64:
vim-enhanced-9.0.475-1.1.amzn1.x86_64
vim-common-9.0.475-1.1.amzn1.x86_64
vim-debuginfo-9.0.475-1.1.amzn1.x86_64
vim-minimal-9.0.475-1.1.amzn1.x86_64