CVE-2022-4293 - Floating Point Comparison with Incorrect Operator in vim/vim

Back Back to CVE browser

MEDIUM

Floating Point Comparison with Incorrect Operator in vim/vim

Published Dec 5, 2022

5.5

MEDIUM

CVSS 3.1

EPSS 0.48%

Description

Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.

Affected products

Vendor Vim Product Vim/vim Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <9.0.0804

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Vim

Vim/vim

n/a

Version	Status	Constraints
unspecified	affected	<9.0.0804

Red Hat Enterprise Linux 6

vim

Not affected
Red Hat Enterprise Linux 7

vim

Not affected
Red Hat Enterprise Linux 8

vim

Fix deferred
Red Hat Enterprise Linux 9

vim

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	vim	Not affected	n/a
Red Hat Enterprise Linux 7	vim	Not affected	n/a
Red Hat Enterprise Linux 8	vim	Fix deferred	n/a
Red Hat Enterprise Linux 9	vim	Fix deferred	n/a

Remediation

Red Hat statement

Red Hat Product Security has rated this issue as having a Low security impact, because the "victim" has to run an untrusted file in script mode. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/ and Red Hat Enterprise Linux Life Cycle & Updates Policy: https://access.redhat.com/support/policy/updates/errata/.

Red Hat mitigation

Untrusted vim scripts with -s [scriptin] are not recommended to run.

Weaknesses (3)

CWE-1077

CWE-369

CWE-697

References (8)

https://access.redhat.com/security/cve/CVE-2022-4293
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2151566
Issue Tracking
https://github.com/vim/vim/commit/cdef1cefa2a440911c727558562f83ed9b00e16b
PatchThird Party Advisory
https://huntr.dev/bounties/385a835f-6e33-4d00-acce-ac99f3939143
ExploitPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-4293
https://security.gentoo.org/glsa/202305-16
vendor-advisory
https://security.netapp.com/advisory/ntap-20230203-0007/
https://www.cve.org/CVERecord?id=CVE-2022-4293

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-4293		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2151566		Issue Tracking
https://github.com/vim/vim/commit/cdef1cefa2a440911c727558562f83ed9b00e16b		PatchThird Party Advisory
https://huntr.dev/bounties/385a835f-6e33-4d00-acce-ac99f3939143		ExploitPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-4293
https://security.gentoo.org/glsa/202305-16		vendor-advisory
https://security.netapp.com/advisory/ntap-20230203-0007/
https://www.cve.org/CVERecord?id=CVE-2022-4293