CVE-2022-2182 - Heap-based Buffer Overflow in vim/vim

Back Back to CVE browser

HIGH

Heap-based Buffer Overflow in vim/vim

Published Jun 23, 2022

7.8

HIGH

CVSS 3.1

EPSS 1.55%

Description

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

Affected products

Vendor Vim Product Vim/vim Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <8.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Vim

Vim/vim

n/a

Version	Status	Constraints
unspecified	affected	<8.2

Red Hat Enterprise Linux 6

vim

Out of support scope
Red Hat Enterprise Linux 7

vim

Out of support scope
Red Hat Enterprise Linux 8

vim

Fix deferred
Red Hat Enterprise Linux 9

vim

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	vim	Out of support scope	n/a
Red Hat Enterprise Linux 7	vim	Out of support scope	n/a
Red Hat Enterprise Linux 8	vim	Fix deferred	n/a
Red Hat Enterprise Linux 9	vim	Fix deferred	n/a

Remediation

Red Hat statement

Red Hat Product Security has rated this issue as having a Low security impact, because the "victim" has to run an untrusted file IN SCRIPT MODE. Someone who is running untrusted files in script mode is equivalent to someone just taking a random python script and running it. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/

Red Hat mitigation

Untrusted vim scripts with -s [scriptin] are not recommended to run.

Weaknesses (1)

CWE-122

References (11)

https://access.redhat.com/security/cve/CVE-2022-2182
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2102153
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34466
Advisory
https://github.com/vim/vim/commit/f7c7c3fad6d2135d558f3b36d0d1a943118aeb5e
PatchThird Party Advisory
https://huntr.dev/bounties/238d8650-3beb-4831-a8f7-6f0b597a6fb8
ExploitPatchThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/
vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/
vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-2182
https://security.gentoo.org/glsa/202208-32
vendor-advisoryThird Party Advisory
https://security.gentoo.org/glsa/202305-16
vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2022-2182

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-2182		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2102153		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34466		Advisory
https://github.com/vim/vim/commit/f7c7c3fad6d2135d558f3b36d0d1a943118aeb5e		PatchThird Party Advisory
https://huntr.dev/bounties/238d8650-3beb-4831-a8f7-6f0b597a6fb8		ExploitPatchThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/		vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/		vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-2182
https://security.gentoo.org/glsa/202208-32		vendor-advisoryThird Party Advisory
https://security.gentoo.org/glsa/202305-16		vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2022-2182