USN-5458-1

Source
https://ubuntu.com/security/notices/USN-5458-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/USN-5458-1.json
Related
Published
2022-06-02T12:21:05.546226Z
Modified
2022-06-02T12:21:05.546226Z
Summary
vim vulnerabilities
Details

It was discovered that Vim was incorrectly handling virtual column position operations, which could result in an out-of-bounds read. An attacker could possibly use this issue to expose sensitive information. (CVE-2021-4193)

It was discovered that Vim was not properly performing bounds checks when updating windows present on a screen, which could result in a heap buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2022-0213)

It was discovered that Vim was incorrectly handling window exchanging operations when in Visual mode, which could result in an out-of-bounds read. An attacker could possibly use this issue to expose sensitive information. (CVE-2022-0319)

It was discovered that Vim was incorrectly handling recursion when parsing conditional expressions. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2022-0351)

It was discovered that Vim was not properly handling memory allocation when processing data in Ex mode, which could result in a heap buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2022-0359)

It was discovered that Vim was not properly performing bounds checks when executing line operations in Visual mode, which could result in a heap buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2022-0361, CVE-2022-0368)

It was discovered that Vim was not properly handling loop conditions when looking for spell suggestions, which could result in a stack buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2022-0408)

It was discovered that Vim was incorrectly handling memory access when executing buffer operations, which could result in the usage of freed memory. An attacker could possibly use this issue to execute arbitrary code. (CVE-2022-0443)

References

Affected packages

Ubuntu:Pro:16.04:LTS / vim

Package

Name
vim

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
2:7.4.1689-3ubuntu1.5+esm5

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "vim-gui-common": "2:7.4.1689-3ubuntu1.5+esm5",
            "vim-gtk-py2": "2:7.4.1689-3ubuntu1.5+esm5",
            "vim-tiny": "2:7.4.1689-3ubuntu1.5+esm5",
            "vim-gtk": "2:7.4.1689-3ubuntu1.5+esm5",
            "vim-athena": "2:7.4.1689-3ubuntu1.5+esm5",
            "vim-nox": "2:7.4.1689-3ubuntu1.5+esm5",
            "vim-doc": "2:7.4.1689-3ubuntu1.5+esm5",
            "vim-gnome": "2:7.4.1689-3ubuntu1.5+esm5",
            "vim": "2:7.4.1689-3ubuntu1.5+esm5",
            "vim-gnome-py2": "2:7.4.1689-3ubuntu1.5+esm5",
            "vim-athena-py2": "2:7.4.1689-3ubuntu1.5+esm5",
            "vim-common": "2:7.4.1689-3ubuntu1.5+esm5",
            "vim-gtk3-py2": "2:7.4.1689-3ubuntu1.5+esm5",
            "vim-gtk3": "2:7.4.1689-3ubuntu1.5+esm5",
            "vim-nox-py2": "2:7.4.1689-3ubuntu1.5+esm5",
            "vim-runtime": "2:7.4.1689-3ubuntu1.5+esm5"
        }
    ]
}