CVE-2022-1897 - Out-of-bounds Write in vim/vim

HIGH

Out-of-bounds Write in vim/vim

Published May 27, 2022

7.8

HIGH

CVSS 3.1

EPSS 1.54%

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
unspecified	affected	<8.2

Red Hat Enterprise Linux 8

vim-2:8.0.1763-19.el8_6.4

Fixed · RHSA-2022:5813
Red Hat Enterprise Linux 8

vim-2:8.0.1763-19.el8_6.4

Fixed · RHSA-2022:5813
Red Hat Enterprise Linux 9

vim-2:8.2.2637-16.el9_0.3

Fixed · RHSA-2022:5942
Red Hat Enterprise Linux 9

vim-2:8.2.2637-16.el9_0.3

Fixed · RHSA-2022:5942
Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

vim-2:8.0.1763-19.el8_6.4

Fixed · RHSA-2022:5813
Red Hat Enterprise Linux 6

vim

Not affected
Red Hat Enterprise Linux 7

vim

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	vim-2:8.0.1763-19.el8_6.4	Fixed	RHSA-2022:5813
Red Hat Enterprise Linux 8	vim-2:8.0.1763-19.el8_6.4	Fixed	RHSA-2022:5813
Red Hat Enterprise Linux 9	vim-2:8.2.2637-16.el9_0.3	Fixed	RHSA-2022:5942
Red Hat Enterprise Linux 9	vim-2:8.2.2637-16.el9_0.3	Fixed	RHSA-2022:5942
Red Hat Virtualization 4 for Red Hat Enterprise Linux 8	vim-2:8.0.1763-19.el8_6.4	Fixed	RHSA-2022:5813
Red Hat Enterprise Linux 6	vim	Not affected	n/a
Red Hat Enterprise Linux 7	vim	Not affected	n/a

Red Hat mitigation

Untrusted vim scripts with -s [scriptin] are not recommended to run.

Weaknesses (1)

CWE-787

Out-of-bounds Write

Link	Providers	Tags
http://seclists.org/fulldisclosure/2022/Oct/28		mailing-listMailing ListThird Party Advisory
http://seclists.org/fulldisclosure/2022/Oct/41		mailing-listMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2022-1897		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2091682		Issue Tracking
https://github.com/vim/vim/commit/338f1fc0ee3ca929387448fe464579d6113fa76a		PatchThird Party Advisory
https://huntr.dev/bounties/82c12151-c283-40cf-aa05-2e39efa89118		ExploitPatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html		mailing-listMailing ListThird Party Advisory
https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OZSLFIKFYU5Y2KM5EJKQNYHWRUBDQ4GJ/		vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMFHBC5OQXDPV2SDYA2JUQGVCPYASTJB/		vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TYNK6SDCMOLQJOI3B4AOE66P2G2IH4ZM/		vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-1897
https://security.gentoo.org/glsa/202208-32		vendor-advisoryThird Party Advisory
https://security.gentoo.org/glsa/202305-16		vendor-advisory
https://support.apple.com/kb/HT213488		Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-1897