ALAS2022-2022-014

References: CVE-2021-4019  CVE-2021-4069  CVE-2021-4136  CVE-2021-4166  CVE-2021-4173  CVE-2021-4187  CVE-2021-4192  CVE-2021-4193  CVE-2022-0128  CVE-2022-0156  CVE-2022-0158 

Issue Overview:

A flaw was found in vim. A possible heap-based buffer overflow vulnerability allows an attacker to input a specially crafted file, leading to a crash or code execution. The highest threat from this vulnerability is system availability. (CVE-2021-4019)

vim is vulnerable to Use After Free (CVE-2021-4069)

A flaw was found in vim. A possible heap-based buffer overflow could allow an attacker to input a specially crafted file leading to a crash or code execution. (CVE-2021-4136)

A flaw was found in vim. A possible heap-based buffer overflow could allow an attacker to input a specially crafted file leading to a crash or code execution. (CVE-2021-4166)

A flaw was found in vim. A possible use after free vulnerability could allow an attacker to input a specially crafted file leading to a crash or code execution. (CVE-2021-4173)

A flaw was found in vim. A possible use after free vulnerability could allow an attacker to input a specially crafted file leading to a crash or code execution. (CVE-2021-4187)

It was found that vim was vulnerable to use-after-free flaw in win_linetabsize(). Sourcing a specially crafted file in vim could crash the vim process or possibly lead to other undefined behaviors. (CVE-2021-4192)

It was found that vim was vulnerable to an out-of-bound read flaw in getvcol(). A specially crafted file could be used to, when opened in vim, disclose some of the process's internal memory. (CVE-2021-4193)

vim is vulnerable to Out-of-bounds Read (CVE-2022-0128)

It was found that vim was vulnerable to use-after-free flaw in the way it was treating allocated lines in user functions. A specially crafted file could crash the vim process or possibly lead to other undefined behaviors. (CVE-2022-0156)

It was found that vim was vulnerable to a 1 byte heap based out of bounds read flaw in the `compile_get_env()` function. A file could use that flaw to disclose 1 byte of vim's internal memory. (CVE-2022-0158)

Issue Correction:
Run dnf update --releasever=2022.0.20220125 vim to update your system.

New Packages:

aarch64:
    vim-X11-debuginfo-8.2.4051-1.amzn2022.aarch64
    vim-debuginfo-8.2.4051-1.amzn2022.aarch64
    vim-enhanced-8.2.4051-1.amzn2022.aarch64
    vim-enhanced-debuginfo-8.2.4051-1.amzn2022.aarch64
    vim-minimal-8.2.4051-1.amzn2022.aarch64
    vim-minimal-debuginfo-8.2.4051-1.amzn2022.aarch64
    vim-X11-8.2.4051-1.amzn2022.aarch64
    vim-common-debuginfo-8.2.4051-1.amzn2022.aarch64
    vim-debugsource-8.2.4051-1.amzn2022.aarch64
    vim-common-8.2.4051-1.amzn2022.aarch64

i686:
    vim-X11-debuginfo-8.2.4051-1.amzn2022.i686
    vim-enhanced-debuginfo-8.2.4051-1.amzn2022.i686
    vim-debugsource-8.2.4051-1.amzn2022.i686
    vim-common-8.2.4051-1.amzn2022.i686
    vim-X11-8.2.4051-1.amzn2022.i686
    vim-enhanced-8.2.4051-1.amzn2022.i686
    vim-minimal-debuginfo-8.2.4051-1.amzn2022.i686
    vim-minimal-8.2.4051-1.amzn2022.i686
    vim-debuginfo-8.2.4051-1.amzn2022.i686
    vim-common-debuginfo-8.2.4051-1.amzn2022.i686

noarch:
    vim-data-8.2.4051-1.amzn2022.noarch
    vim-default-editor-8.2.4051-1.amzn2022.noarch
    vim-filesystem-8.2.4051-1.amzn2022.noarch

src:
    vim-8.2.4051-1.amzn2022.src

x86_64:
    vim-X11-debuginfo-8.2.4051-1.amzn2022.x86_64
    vim-enhanced-debuginfo-8.2.4051-1.amzn2022.x86_64
    vim-debugsource-8.2.4051-1.amzn2022.x86_64
    vim-debuginfo-8.2.4051-1.amzn2022.x86_64
    vim-common-debuginfo-8.2.4051-1.amzn2022.x86_64
    vim-minimal-debuginfo-8.2.4051-1.amzn2022.x86_64
    vim-minimal-8.2.4051-1.amzn2022.x86_64
    vim-enhanced-8.2.4051-1.amzn2022.x86_64
    vim-X11-8.2.4051-1.amzn2022.x86_64
    vim-common-8.2.4051-1.amzn2022.x86_64