Bug 2104416 (CVE-2022-2304)

Summary:	CVE-2022-2304 vim: stack buffer overflow in spell_dump_compl() at spell.c
Product:	[Other] Security Response	Reporter:	TEJ RATHI <trathi>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	gchamoul, karsten, zdohnal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	vim 9.0.0035	Doc Type:	If docs needed, set a value
Doc Text:	A stack-based buffer overflow vulnerability was found in Vim's spell_dump_compl() function of the src/spell.c file. This issue occurs because the spell dump goes beyond the end of an array when crafted input is processed. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering an out-of-bounds write that causes an application to crash, possibly executing code and corrupting memory.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2104417, 2104460
Bug Blocks:	2104136

Description TEJ RATHI 2022-07-06 08:31:43 UTC

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.

https://github.com/vim/vim/commit/54e5fed6d27b747ff152cdb6edfb72ff60e70939
https://huntr.dev/bounties/eb7402f3-025a-402f-97a7-c38700d9548a

Comment 1 TEJ RATHI 2022-07-06 08:32:02 UTC

Created vim tracking bugs for this issue:

Affects: fedora-all [bug 2104417]