Bug 2129831 (CVE-2022-3278)

Summary:	CVE-2022-3278 vim: null pointer dereference in eval_next_non_blank() in eval.c
Product:	[Other] Security Response	Reporter:	TEJ RATHI <trathi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	gchamoul, karsten, zdohnal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	vim 9.0.0552	Doc Type:	If docs needed, set a value
Doc Text:	A NULL pointer dereference vulnerability was found in Vim's eval_next_non_blank() function of the src/eval.c file. The flaw occurs when using NUL in buffer uses :source. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering a NULL pointer dereference that causes a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	2129833, 2132748
Bug Blocks:	2129840

Description TEJ RATHI 2022-09-26 12:02:07 UTC

NULL Pointer Dereference in vim/vim prior to 9.0.0552.

https://github.com/vim/vim/commit/69082916c8b5d321545d60b9f5facad0a2dd5a4e
https://huntr.dev/bounties/a9fad77e-f245-4ce9-ba15-c7d4c86c4612

Comment 1 TEJ RATHI 2022-09-26 12:02:24 UTC

Created vim tracking bugs for this issue:

Affects: fedora-all [bug 2129833]