CVE-2022-0368 - Out-of-bounds Read in vim/vim

HIGH

Out-of-bounds Read in vim/vim

Published Jan 26, 2022

7.8

HIGH

CVSS 3.1

EPSS 1.52%

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
unspecified	affected	<8.2

Product	Package	State	Advisory
Red Hat Advanced Cluster Management for Kubernetes 2	vim	Not affected	n/a
Red Hat Enterprise Linux 6	vim	Not affected	n/a
Red Hat Enterprise Linux 7	vim	Not affected	n/a
Red Hat Enterprise Linux 8	vim	Not affected	n/a
Red Hat Enterprise Linux 9	vim	Not affected	n/a
Red Hat OpenShift Virtualization 2	vim	Not affected	n/a
Red Hat OpenShift Virtualization 4	vim	Not affected	n/a
Red Hat Virtualization 4	vim	Not affected	n/a

Red Hat mitigation

Untrusted vim scripts with -s [scriptin] are not recommended to run.

Weaknesses (1)

CWE-125

Out-of-bounds Read

Link	Providers	Tags
http://seclists.org/fulldisclosure/2022/Oct/28		mailing-listMailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2022/Oct/41		mailing-listMailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2022/Oct/43		mailing-listMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2022-0368		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2048353		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-15523		Advisory
https://github.com/vim/vim/commit/8d02ce1ed75d008c34a5c9aaa51b67cbb9d33baa		PatchThird Party Advisory
https://huntr.dev/bounties/bca9ce1f-400a-4bf9-9207-3f3187cb3fa9		ExploitIssue TrackingPatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html		mailing-listMailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html		mailing-listMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-0368
https://security.gentoo.org/glsa/202208-32		vendor-advisoryThird Party Advisory
https://support.apple.com/kb/HT213444		Vendor Advisory
https://support.apple.com/kb/HT213488		Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2022-0368