2101293 – (CVE-2022-2175) CVE-2022-2175 vim: buffer over-read in put_on_cmdline() at ex_getln.c

Bug 2101293 (CVE-2022-2175) - CVE-2022-2175 vim: buffer over-read in put_on_cmdline() at ex_getln.c

Summary: CVE-2022-2175 vim: buffer over-read in put_on_cmdline() at ex_getln.c

Keywords:
Status:	NEW
Alias:	CVE-2022-2175
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	low
Severity:	low
Target Milestone:	---
Assignee:	Nobody
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:	2101815 2101816 2101817
Blocks:	2101294
TreeView+	depends on / blocked

Reported:	2022-06-27 05:18 UTC by Avinash Hanwate
Modified:	2023-07-07 08:29 UTC (History)
CC List:	3 users (show)
Fixed In Version:	vim 8.2.5148
Doc Type:	If docs needed, set a value
Doc Text:	A heap buffer over-read vulnerability was found in Vim's put_on_cmdline() function of the src/ex_getln.c file. This issue occurs due to invalid memory access when using an expression on the command line. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering a heap buffer overflow that causes an application to crash and corrupt memory.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments	(Terms of Use)

Description Avinash Hanwate 2022-06-27 05:18:38 UTC

Buffer Over-read in GitHub repository vim/vim prior to 8.2.

https://github.com/vim/vim/commit/6046aded8da002b08d380db29de2ba0268b6616e
https://huntr.dev/bounties/7f0481c2-8b57-4324-b47c-795d1ea67e55

Comment 2 TEJ RATHI 2022-06-28 12:48:44 UTC

Created vim tracking bugs for this issue:

Affects: fedora-all [bug 2101815]

Note You need to log in before you can comment on or make changes to this bug.