CVE-2022-0368: Out-of-bounds Read in vim/vim

Reference Links

• http://seclists.org/fulldisclosure/2022/Oct/28
• http://seclists.org/fulldisclosure/2022/Oct/41
• http://seclists.org/fulldisclosure/2022/Oct/43
• https://github.com/vim/vim/commit/8d02ce1ed75d008c34a5c9aaa51b67cbb9d33baa
• https://huntr.dev/bounties/bca9ce1f-400a-4bf9-9207-3f3187cb3fa9
• https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html
• https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
• https://security.gentoo.org/glsa/202208-32
• https://support.apple.com/kb/HT213444
• https://support.apple.com/kb/HT213488
• https://launchpad.net/bugs/cve/CVE-2022-0368
• https://support.apple.com/en-us/HT213444 (Advisory)
• https://support.apple.com/en-us/HT213488 (Advisory)
• https://huntr.dev/bounties/bca9ce1f-400a-4bf9-9207-3f3187cb3fa9/
• https://security-tracker.debian.org/tracker/CVE-2022-0368
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0368
• https://nvd.nist.gov/vuln/detail/CVE-2022-0368
• https://ubuntu.com/security/CVE-2022-0368

Parent vulnerabilities

(Appears in the following advisories)

• HT213444
• HT213488

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2022-42789
• CVE-2022-32902
• CVE-2022-32904
• CVE-2022-42819
• CVE-2022-32877
• CVE-2022-1622
• CVE-2022-32913
• CVE-2022-32896
• CVE-2022-46701
• CVE-2022-32914
• CVE-2022-32911
• CVE-2022-32866
• CVE-2022-32924
• CVE-2022-32864
• CVE-2022-32917
• CVE-2022-32883
• CVE-2022-32908
• CVE-2021-39537
• CVE-2022-42818
• CVE-2022-32900
• CVE-2022-32881
• CVE-2022-42793
• CVE-2022-42790
• CVE-2022-32934
• CVE-2022-0261
• CVE-2022-0318
• CVE-2022-0319
• CVE-2022-0351
• CVE-2022-0359
• CVE-2022-0361
• CVE-2022-0368
• CVE-2022-0392
• CVE-2022-1720
• CVE-2022-2000
• CVE-2022-2042
• CVE-2022-2124
• CVE-2022-2125
• CVE-2022-2126
• CVE-2022-32875
• CVE-2022-32888
• CVE-2022-42795
• CVE-2022-48577
• CVE-2022-32858
• CVE-2022-32898
• CVE-2022-32899
• CVE-2022-46721
• CVE-2022-47915
• CVE-2022-47965
• CVE-2022-32889
• CVE-2022-32907
• CVE-2022-32827
• CVE-2022-42825
• CVE-2022-46722
• CVE-2022-32890
• CVE-2022-42796
• CVE-2022-42798
• CVE-2022-32940
• CVE-2022-42816
• CVE-2022-42821
• CVE-2022-42860
• CVE-2022-42813
• CVE-2022-26730
• CVE-2022-32945
• CVE-2022-42838
• CVE-2022-48683
• CVE-2022-22663
• CVE-2022-32867
• CVE-2022-32205
• CVE-2022-32206
• CVE-2022-32207
• CVE-2022-32208
• CVE-2022-42814
• CVE-2022-32865
• CVE-2022-32915
• CVE-2022-32928
• CVE-2022-22643
• CVE-2022-32935
• CVE-2022-42788
• CVE-2022-48504
• CVE-2022-32905
• CVE-2022-42833
• CVE-2022-32947
• CVE-2022-42809
• CVE-2022-3437
• CVE-2022-32849
• CVE-2022-32809
• CVE-2022-32936
• CVE-2022-42820
• CVE-2022-42806
• CVE-2022-42808
• CVE-2022-32944
• CVE-2022-42803
• CVE-2022-32926
• CVE-2022-42801
• CVE-2022-46712
• CVE-2022-42815
• CVE-2022-42834
• CVE-2022-46707
• CVE-2022-42810
• CVE-2022-29458
• CVE-2022-32879
• CVE-2022-32895
• CVE-2022-46713
• CVE-2022-42807
• CVE-2022-32918
• CVE-2022-42829
• CVE-2022-42830
• CVE-2022-42831
• CVE-2022-42832
• CVE-2022-32941
• CVE-2022-28739
• CVE-2022-32862
• CVE-2022-32931
• CVE-2022-42811
• CVE-2022-32876
• CVE-2022-32938
• CVE-2022-32870
• CVE-2022-42791
• CVE-2021-36690
• CVE-2022-48505
• CVE-2022-26699
• CVE-2022-0554
• CVE-2022-0572
• CVE-2022-0629
• CVE-2022-0685
• CVE-2022-0696
• CVE-2022-0714
• CVE-2022-0729
• CVE-2022-0943
• CVE-2022-1381
• CVE-2022-1420
• CVE-2022-1725
• CVE-2022-1616
• CVE-2022-1619
• CVE-2022-1620
• CVE-2022-1621
• CVE-2022-1629
• CVE-2022-1674
• CVE-2022-1733
• CVE-2022-1735
• CVE-2022-1769
• CVE-2022-1927
• CVE-2022-1942
• CVE-2022-1968
• CVE-2022-1851
• CVE-2022-1897
• CVE-2022-1898
• CVE-2022-42828
• CVE-2022-42826
• CVE-2022-32886
• CVE-2022-32912
• CVE-2022-42799
• CVE-2022-42823
• CVE-2022-42824
• CVE-2022-32923
• CVE-2022-32922
• CVE-2022-32892
• CVE-2022-32833
• CVE-2022-46709
• CVE-2022-37434
• CVE-2022-42800

Frequently Asked Questions

• What is CVE-2022-0368?

  CVE-2022-0368 is a vulnerability in Vim that involves an out-of-bounds write issue.

• Which software is affected by CVE-2022-0368?

  CVE-2022-0368 affects Apple macOS Monterey (up to version 12.6), Ubuntu Vim (up to version 2:8.0.1453-1ubuntu1.13, 2:8.1.2269-1ubuntu5.14, 2:8.2.3995-1ubuntu2.7, and 8.2.4217), Ubuntu Vim from upstream (up to version 8.2.4217), Ubuntu Vim (up to version 2:7.4.1689-3ubuntu1.5+), Apple macOS Ventura (up to version 13), and Debian Vim (up to version 2:8.2.2434-3+deb11u1, 2:8.1.0875-5+deb10u5, 2:9.0.1378-2, and 2:9.0.1894-1).

• How severe is CVE-2022-0368?

  The severity of CVE-2022-0368 is not specified in the information provided.

• How can I fix CVE-2022-0368 on Ubuntu?

  To fix CVE-2022-0368 on Ubuntu, update Vim to version 2:8.1.1453-1ubuntu1.14 or later for Ubuntu Bionic, version 2:8.1.2269-1ubuntu5.15 or later for Ubuntu Focal, and version 2:8.2.551-2ubuntu2.8 or later for Ubuntu Jammy.

• Where can I find more information about CVE-2022-0368?

  More information about CVE-2022-0368 can be found at the following references: [Apple Support](https://support.apple.com/en-us/HT213444), [Huntr](https://huntr.dev/bounties/bca9ce1f-400a-4bf9-9207-3f3187cb3fa9), [GitHub Commit](https://github.com/vim/vim/commit/8d02ce1ed75d008c34a5c9aaa51b67cbb9d33baa).