DLA-3204-1

Source

https://storage.googleapis.com/debian-osv/dla-osv/DLA-3204-1.json

Aliases

• CVE-2022-0318 ( ALSA-2022:0894, RLSA-2022:0894 )
• CVE-2022-0392 ( ALSA-2022:0894, RLSA-2022:0894 )
• CVE-2022-0629
• CVE-2022-0696
• CVE-2022-1619 ( DLA-3011-1 )
• CVE-2022-1621 ( DLA-3011-1, ALSA-2022:5242, ALSA-2022:5319, RLSA-2022:5319 )
• CVE-2022-1785 ( ALSA-2022:5813, ALSA-2022:5942, RLSA-2022:5813, RLSA-2022:5942 )
• CVE-2022-1897 ( ALSA-2022:5813, ALSA-2022:5942, RLSA-2022:5813, RLSA-2022:5942 )
• CVE-2022-1942
• CVE-2022-2000
• CVE-2022-2129
• CVE-2022-3235
• CVE-2022-3256
• CVE-2022-3352

Published

2022-11-24T00:00:00Z

Modified

2022-11-24T15:03:56.385713Z

Details

This update fixes multiple memory access violations in vim.

• CVE-2022-0318 Heap-based Buffer Overflow
• CVE-2022-0392 Heap-based Buffer Overflow
• CVE-2022-0629 Stack-based Buffer Overflow
• CVE-2022-0696 NULL Pointer Dereference
• CVE-2022-1619 Heap-based Buffer Overflow in function cmdline_erase_chars. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution
• CVE-2022-1621 Heap buffer overflow in vim_strncpy find_word. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
• CVE-2022-1785 Out-of-bounds Write
• CVE-2022-1897 Out-of-bounds Write
• CVE-2022-1942 Heap-based Buffer Overflow
• CVE-2022-2000 Out-of-bounds Write
• CVE-2022-2129 Out-of-bounds Write
• CVE-2022-3235 Use After Free
• CVE-2022-3256 Use After Free
• CVE-2022-3352 Use After Free

For Debian 10 buster, these problems have been fixed in version 2:8.1.0875-5+deb10u4.

We recommend that you upgrade your vim packages.

For the detailed security status of vim please refer to its security tracker page at: https://security-tracker.debian.org/tracker/vim

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

References

• https://www.debian.org/lts/security/2022/dla-3204