CVE-2021-4166: Out-of-bounds Read in vim/vim
First published: Sat Dec 25 2021(Updated: )
Last updated 24 July 2024
Credit: security@huntr.dev CVE-2021-4136 CVE-2021-4166 CVE-2021-4173 CVE-2021-4187 CVE-2021-4192 CVE-2021-4193 CVE-2021-46059 CVE-2022-0128 CVE-2022-0156 CVE-2022-0158 CVE-2021-4136 CVE-2021-4166 CVE-2021-4173 CVE-2021-4187 CVE-2021-4192 CVE-2021-4193 CVE-2021-46059 CVE-2022-0128 security@huntr.dev CVE-2021-4136 CVE-2021-4166 CVE-2021-4173 CVE-2021-4187 CVE-2021-4192 CVE-2021-4193 CVE-2021-46059 CVE-2022-0128 security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Vim Vim | <8.2.3884 | |
| Redhat Enterprise Linux | =8.0 | |
| openSUSE Factory | ||
| SUSE Linux Enterprise | =12.0 | |
| SUSE Linux Enterprise | =15.0 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 | |
| Fedoraproject Fedora | =34 | |
| Fedoraproject Fedora | =35 | |
| Apple Mac OS X | =10.15.7 | |
| Apple Mac OS X | =10.15.7-security_update_2020-001 | |
| Apple Mac OS X | =10.15.7-security_update_2021-001 | |
| Apple Mac OS X | =10.15.7-security_update_2021-002 | |
| Apple Mac OS X | =10.15.7-security_update_2021-003 | |
| Apple Mac OS X | =10.15.7-security_update_2021-004 | |
| Apple Mac OS X | =10.15.7-security_update_2021-005 | |
| Apple Mac OS X | =10.15.7-security_update_2021-006 | |
| Apple Mac OS X | =10.15.7-security_update_2021-007 | |
| Apple Mac OS X | =10.15.7-security_update_2021-008 | |
| Apple Mac OS X | =10.15.7-security_update_2022-001 | |
| Apple Mac OS X | =10.15.7-security_update_2022-002 | |
| Apple Mac OS X | =10.15.7-security_update_2022-003 | |
| Apple macOS | <12.3 | |
| Apple macOS | >=11.0<11.6.6 | |
| Apple macOS | =10.15.7-security_update_2022-004 | |
| Apple macOS Monterey | <12.3 | 12.3 |
| Apple Catalina | ||
| Apple macOS Big Sur | <11.6.6 | 11.6.6 |
| debian/vim | <=2:8.2.2434-3+deb11u1 | 2:9.0.1378-2 2:9.1.0861-1 |
| <8.2.3884 | ||
| =8.0 | ||
| =12.0 | ||
| =15.0 | ||
| =9.0 | ||
| =10.0 | ||
| =11.0 | ||
| =34 | ||
| =35 | ||
| =10.15.7 | ||
| =10.15.7-security_update_2020-001 | ||
| =10.15.7-security_update_2021-001 | ||
| =10.15.7-security_update_2021-002 | ||
| =10.15.7-security_update_2021-003 | ||
| =10.15.7-security_update_2021-004 | ||
| =10.15.7-security_update_2021-005 | ||
| =10.15.7-security_update_2021-006 | ||
| =10.15.7-security_update_2021-007 | ||
| =10.15.7-security_update_2021-008 | ||
| =10.15.7-security_update_2022-001 | ||
| =10.15.7-security_update_2022-002 | ||
| =10.15.7-security_update_2022-003 | ||
| <12.3 | ||
| >=11.0<11.6.6 | ||
| =10.15.7-security_update_2022-004 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://seclists.org/fulldisclosure/2022/Jul/14
- http://seclists.org/fulldisclosure/2022/Mar/29
- http://seclists.org/fulldisclosure/2022/May/35
- http://www.openwall.com/lists/oss-security/2022/01/15/1
- https://github.com/vim/vim/commit/6f98371532fcff911b462d51bc64f2ce8a6ae682
- https://huntr.dev/bounties/229df5dd-5507-44e9-832c-c70364bdf035
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EY2VFBU3YGGWI5BW4XKT3F37MYGEQUD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3FH2J57GDA2WMBS6J56F6QQRA6BXQQFZ/
- https://security.gentoo.org/glsa/202208-32
- https://support.apple.com/kb/HT213183
- https://support.apple.com/kb/HT213256
- https://support.apple.com/kb/HT213343
- https://support.apple.com/en-us/HT213183 (Advisory)
- https://support.apple.com/en-us/HT213343 (Advisory)
- https://launchpad.net/bugs/cve/CVE-2021-4166
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2EY2VFBU3YGGWI5BW4XKT3F37MYGEQUD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3FH2J57GDA2WMBS6J56F6QQRA6BXQQFZ/
- https://support.apple.com/en-us/HT213256 (Advisory)
- https://security-tracker.debian.org/tracker/CVE-2021-4166
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4166
- https://nvd.nist.gov/vuln/detail/CVE-2021-4166
- https://ubuntu.com/security/CVE-2021-4166
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2022-22633
- CVE-2022-22669
- CVE-2022-22665
- CVE-2022-22630
- CVE-2022-22631
- CVE-2022-22625
- CVE-2022-22648
- CVE-2022-22626
- CVE-2022-22627
- CVE-2022-22597
- CVE-2022-22616
- CVE-2022-22663
- CVE-2022-26691
- CVE-2021-22946
- CVE-2021-22947
- CVE-2021-22945
- CVE-2022-22643
- CVE-2022-22657
- CVE-2022-22664
- CVE-2021-30977
- CVE-2022-22611
- CVE-2022-22612
- CVE-2022-46706
- CVE-2022-22661
- CVE-2022-22641
- CVE-2022-22613
- CVE-2022-22614
- CVE-2022-22615
- CVE-2022-22632
- CVE-2022-22638
- CVE-2022-22640
- CVE-2021-30946
- CVE-2021-36976
- CVE-2022-21658
- CVE-2022-22647
- CVE-2022-22656
- CVE-2022-22672
- CVE-2022-22644
- CVE-2022-26690
- CVE-2022-26688
- CVE-2022-22617
- CVE-2022-22609
- CVE-2022-22650
- CVE-2022-22655
- CVE-2022-22600
- CVE-2022-22599
- CVE-2022-22651
- CVE-2022-22639
- CVE-2022-22660
- CVE-2022-22621
- CVE-2021-4136
- CVE-2021-4166
- CVE-2021-4173
- CVE-2021-4187
- CVE-2021-4192
- CVE-2021-4193
- CVE-2021-46059
- CVE-2022-0128
- CVE-2022-0156
- CVE-2022-0158
- CVE-2021-30918
- CVE-2022-22662
- CVE-2022-22610
- CVE-2022-22624
- CVE-2022-22628
- CVE-2022-22629
- CVE-2022-22637
- CVE-2022-22668
- CVE-2022-22582
- CVE-2022-32832
- CVE-2022-32826
- CVE-2022-32797
- CVE-2022-32853
- CVE-2022-32851
- CVE-2022-32831
- CVE-2022-32910
- CVE-2022-32820
- CVE-2022-32805
- CVE-2022-32849
- CVE-2022-32839
- CVE-2022-32781
- CVE-2022-32819
- CVE-2022-32787
- CVE-2022-32785
- CVE-2022-32812
- CVE-2022-32811
- CVE-2022-32815
- CVE-2022-32813
- CVE-2022-32823
- CVE-2022-32786
- CVE-2022-32800
- CVE-2022-32838
- CVE-2022-32843
- CVE-2022-32842
- CVE-2022-32799
- CVE-2022-32857
- CVE-2022-32807
- CVE-2022-26704
- CVE-2022-32834
- CVE-2022-32860
- CVE-2022-32837
- CVE-2022-32847
- CVE-2021-44224
- CVE-2021-44790
- CVE-2022-22719
- CVE-2022-22720
- CVE-2022-22721
- CVE-2022-22675
- CVE-2022-26751
- CVE-2022-26698
- CVE-2022-26697
- CVE-2022-26721
- CVE-2022-26722
- CVE-2022-26763
- CVE-2022-22674
- CVE-2022-26720
- CVE-2022-26770
- CVE-2022-26756
- CVE-2022-26769
- CVE-2022-26748
- CVE-2022-26768
- CVE-2022-26714
- CVE-2022-26757
- CVE-2022-26767
- CVE-2022-26706
- CVE-2022-32882
- CVE-2022-32790
- CVE-2022-26776
- CVE-2022-0778
- CVE-2022-23308
- CVE-2022-32794
- CVE-2022-26712
- CVE-2022-26746
- CVE-2022-26731
- CVE-2022-26766
- CVE-2022-26718
- CVE-2022-26723
- CVE-2022-26715
- CVE-2022-26728
- CVE-2022-26726
- CVE-2022-26755
- CVE-2022-22589
- CVE-2022-26745
- CVE-2022-26761
- CVE-2022-0530
- CVE-2018-25032
- CVE-2021-45444
Frequently Asked Questions
What is CVE-2021-4166?
CVE-2021-4166 is a vulnerability that allows for out-of-bounds read in Vim.
How does CVE-2021-4166 impact Vim?
CVE-2021-4166 allows an attacker to read data outside of the bounds of an array in Vim, potentially leading to information disclosure or a crash.
Is Apple Catalina affected by CVE-2021-4166?
Yes, Apple Catalina is affected by CVE-2021-4166.
What is the recommended version of macOS Big Sur to fix CVE-2021-4166?
The recommended version of macOS Big Sur to fix CVE-2021-4166 is 11.6.6.
How can I fix the CVE-2021-4166 vulnerability on Ubuntu?
To fix the CVE-2021-4166 vulnerability on Ubuntu, update the vim package to version 2:8.1.2269-1ubuntu5.14 or later.
How can I fix the CVE-2021-4166 vulnerability on Debian?
To fix the CVE-2021-4166 vulnerability on Debian, update the vim package to version 2:9.0.1378-2 or 2:9.0.1894-1, depending on the Debian version.
- collector/nvd-index
- collector/apple-support
- alias/CVE-2021-4166
- alias/CVE-2021-4173
- alias/CVE-2021-4187
- alias/CVE-2021-4192
- alias/CVE-2021-4193
- alias/CVE-2021-46059
- alias/CVE-2022-0128
- alias/CVE-2022-0156
- alias/CVE-2022-0158
- agent/type
- collector/launchpad-cve
- source/Launchpad
- agent/remedy
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- source/Apple
- agent/software-canonical-lookup
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/description
- agent/first-publish-date
- collector/security-tracker-debian
- source/Debian
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/tags
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- agent/trending
- vendor/vim
- canonical/vim vim
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/8.0
- vendor/opensuse
- canonical/opensuse factory
- vendor/suse
- canonical/suse linux enterprise
- version/suse linux enterprise/12.0
- version/suse linux enterprise/15.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- version/debian debian linux/11.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/34
- version/fedoraproject fedora/35
- vendor/apple
- canonical/apple mac os x
- version/apple mac os x/10.15.7
- version/apple mac os x/10.15.7-security_update_2020-001
- version/apple mac os x/10.15.7-security_update_2021-001
- version/apple mac os x/10.15.7-security_update_2021-002
- version/apple mac os x/10.15.7-security_update_2021-003
- version/apple mac os x/10.15.7-security_update_2021-004
- version/apple mac os x/10.15.7-security_update_2021-005
- version/apple mac os x/10.15.7-security_update_2021-006
- version/apple mac os x/10.15.7-security_update_2021-007
- version/apple mac os x/10.15.7-security_update_2021-008
- version/apple mac os x/10.15.7-security_update_2022-001
- version/apple mac os x/10.15.7-security_update_2022-002
- version/apple mac os x/10.15.7-security_update_2022-003
- canonical/apple macos
- version/apple macos/11.0
- version/apple macos/10.15.7-security_update_2022-004
- canonical/apple macos monterey
- canonical/apple catalina
- canonical/apple macos big sur
- package-manager/debian