Bug 2083931 (CVE-2022-1629)
| Summary: | CVE-2022-1629 vim: buffer over-read in function find_next_quote | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Anten Skrabec <askrabec> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | fhrdina, gchamoul, karsten, michal.skrivanek, mperina, sbonazzo, zdohnal |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | vim 8.2.4925 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in vim, where it is vulnerable to a buffer over-read in the find_next_quote function. This flaw allows a specially crafted file to crash software, modify memory and possibly perform remote execution when opened in vim.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-07-01 11:41:46 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2083932, 2083935, 2085346, 2088274, 2088275, 2088276, 2088277 | ||
| Bug Blocks: | 2083930 | ||
|
Description
Anten Skrabec
2022-05-11 04:00:15 UTC
Created vim tracking bugs for this issue: Affects: fedora-34 [bug 2083932] Created vim tracking bugs for this issue: Affects: fedora-35 [bug 2083935] Hi, can you please elaborate on how is it possible that RHV is considered affected while RHEL is under investigation? RHV just consume RHEL builds so it's not clear to me how this is possible. This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:5242 https://access.redhat.com/errata/RHSA-2022:5242 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:5319 https://access.redhat.com/errata/RHSA-2022:5319 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-1629 |