Bug 2083924 (CVE-2022-1621)
| Summary: | CVE-2022-1621 vim: heap buffer overflow in vim_strncpy | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Anten Skrabec <askrabec> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | ahanwate, fhrdina, gchamoul, karsten, michal.skrivanek, mperina, sbonazzo, trathi, zdohnal |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | vim 8.2.4919 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in vim, where it is vulnerable to a heap buffer overflow in the vim_strncpy find_word function. This flaw allows a specially crafted file to crash software, modify memory and possibly perform remote execution when opened in vim.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-07-01 11:24:35 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2083927, 2083929, 2085345, 2088260, 2088261, 2088262, 2088263 | ||
| Bug Blocks: | 2083930 | ||
|
Description
Anten Skrabec
2022-05-11 03:36:08 UTC
Created vim tracking bugs for this issue: Affects: fedora-34 [bug 2083927] Created vim tracking bugs for this issue: Affects: fedora-35 [bug 2083929] Hi, can you please elaborate on how is it possible that RHV is considered affected while RHEL is under investigation? RHV just consume RHEL builds so it's not clear to me how this is possible. This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:5242 https://access.redhat.com/errata/RHSA-2022:5242 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:5319 https://access.redhat.com/errata/RHSA-2022:5319 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-1621 |