{"id":"MGASA-2022-0430","summary":"Updated vim packages fix security vulnerability","details":"Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.\n(CVE-2022-2000, CVE-2022-2129, CVE-2022-2210)\n\nUse After Free in GitHub repository vim/vim prior to 8.2. (CVE-2022-2042)\n\nBuffer Over-read in GitHub repository vim/vim prior to 8.2.\n(CVE-2022-2124, CVE-2022-2175)\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.\n(CVE-2022-2125, CVE-2022-2182, CVE-2022-2207)\n\nOut-of-bounds Read in GitHub repository vim/vim prior to 8.2.\n(CVE-2022-2126, CVE-2022-2183, CVE-2022-2206)\n\nNULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163.\n(CVE-2022-2208)\n\nNULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.\n(CVE-2022-2231)\n\nOut-of-bounds Read in GitHub repository vim/vim prior to 9.0.\n(CVE-2022-2257, CVE-2022-2286, CVE-2022-2287, CVE-2022-2288)\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.\n(CVE-2022-2264, CVE-2022-2284)\n\nInteger Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.\n(CVE-2022-2285)\n\nUse After Free in GitHub repository vim/vim prior to 9.0. (CVE-2022-2289)\n\nStack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.\n(CVE-2022-2304)\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044.\n(CVE-2022-2343)\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045.\n(CVE-2022-2344)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0046.\n(CVE-2022-2345)\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061.\n(CVE-2022-2522)\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0101.\n(CVE-2022-2571)\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0102.\n(CVE-2022-2580)\n\nOut-of-bounds Read in GitHub repository vim/vim prior to 9.0.0104.\n(CVE-2022-2581)\n\nUndefined Behavior for Input to API in GitHub repository vim/vim prior to\n9.0.0100. (CVE-2022-2598)\n\nOut-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212.\n(CVE-2022-2816)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0213.\n(CVE-2022-2817)\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211.\n(CVE-2022-2819)\n\nBuffer Over-read in GitHub repository vim/vim prior to 9.0.0218.\n(CVE-2022-2845)\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220.\n(CVE-2022-2849)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0221.\n(CVE-2022-2862)\n\nNULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224.\n(CVE-2022-2874)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0225.\n(CVE-2022-2889)\n\nNULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240.\n(CVE-2022-2923)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0246.\n(CVE-2022-2946)\n\nNULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0259.\n(CVE-2022-2980)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0260.\n(CVE-2022-2982)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0286.\n(CVE-2022-3016)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0322.\n(CVE-2022-3037)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0360.\n(CVE-2022-3099)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0389.\n(CVE-2022-3134)\n\nHeap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483.\n(CVE-2022-3234)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0490.\n(CVE-2022-3235)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0530.\n(CVE-2022-3256)\n\nNULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552.\n(CVE-2022-3278)\n\nStack-based Buffer Overflow in GitHub repository vim/vim prior to\n9.0.0577. (CVE-2022-3296)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0579.\n(CVE-2022-3297)\n\nStack-based Buffer Overflow in GitHub repository vim/vim prior to\n9.0.0598. (CVE-2022-3324)\n\nUse After Free in GitHub repository vim/vim prior to 9.0.0614.\n(CVE-2022-3352)\n\nAffected by this issue is the function qf_update_buffer of the file\nquickfix.c of the component autocmd Handler. The manipulation leads to use\nafter free. The attack may be launched remotely. (CVE-2022-3705)\n","modified":"2026-04-16T04:42:28.202864031Z","published":"2022-11-18T22:50:51Z","upstream":["CVE-2022-2000","CVE-2022-2042","CVE-2022-2124","CVE-2022-2125","CVE-2022-2126","CVE-2022-2129","CVE-2022-2175","CVE-2022-2182","CVE-2022-2183","CVE-2022-2206","CVE-2022-2207","CVE-2022-2208","CVE-2022-2210","CVE-2022-2231","CVE-2022-2257","CVE-2022-2264","CVE-2022-2284","CVE-2022-2285","CVE-2022-2286","CVE-2022-2287","CVE-2022-2288","CVE-2022-2289","CVE-2022-2304","CVE-2022-2343","CVE-2022-2344","CVE-2022-2345","CVE-2022-2522","CVE-2022-2571","CVE-2022-2580","CVE-2022-2581","CVE-2022-2598","CVE-2022-2816","CVE-2022-2817","CVE-2022-2819","CVE-2022-2845","CVE-2022-2849","CVE-2022-2862","CVE-2022-2874","CVE-2022-2889","CVE-2022-2923","CVE-2022-2946","CVE-2022-2980","CVE-2022-2982","CVE-2022-3016","CVE-2022-3037","CVE-2022-3099","CVE-2022-3134","CVE-2022-3234","CVE-2022-3235","CVE-2022-3256","CVE-2022-3278","CVE-2022-3296","CVE-2022-3297","CVE-2022-3324","CVE-2022-3352","CVE-2022-3705"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2022-0430.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=30561"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4JJNUS4AEVYSEJMCK6JZB57QHD5V2G4O/"},{"type":"WEB","url":"https://www.debian.org/lts/security/2022/dla-3053"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-5492-1"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/CHFAR6OY6G77M6GXCJT75A4KITLNR6GO/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/C72HDIMR3KTTAO7QGTXWUMPBNFUFIBRD/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/RY3GEN2Q46ZJKSNHTN2XB6B3VAJBEILN/"},{"type":"WEB","url":"https://lists.suse.com/pipermail/sle-security-updates/2022-September/012199.html"},{"type":"WEB","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JUQDO2AKYFBQGJNMY6TUKLRL7L6M3NZB/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4JCW33NOLMELTTTDJH7WGDIFJZ5YEEMK/"},{"type":"WEB","url":"https://www.debian.org/lts/security/2022/dla-3182"}],"affected":[{"package":{"name":"vim","ecosystem":"Mageia:8","purl":"pkg:rpm/mageia/vim?arch=source&distro=mageia-8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.828-1.mga8"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2022-0430.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}