CVE-2022-2175: Buffer Over-read in vim/vim
Buffer Over-read in GitHub repository vim/vim prior to 8.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.0.1378-2+deb12u2Fixed in 2:9.1.1230-1 - Upgrade
Upgrade
vim/vimto a version that resolves this vulnerability.Fixed in 8.2
Event History
Frequently Asked Questions
What is CVE-2022-2175?
CVE-2022-2175 is a vulnerability that allows remote attackers to cause a denial of service or execute arbitrary code via a crafted repository clone with a missing object.
How severe is CVE-2022-2175?
CVE-2022-2175 has a severity rating of 7.8 (High).
Which software versions are affected by CVE-2022-2175?
The affected software versions include Vim prior to 8.2.5148 and Fedora 35 and 36.
How can I fix CVE-2022-2175?
To fix CVE-2022-2175, update to Vim version 8.2.5148 or later and apply the necessary patches for Fedora 35 and 36.
Where can I find more information about CVE-2022-2175?
You can find more information about CVE-2022-2175 at the following references: [link 1](https://github.com/vim/vim/commit/6046aded8da002b08d380db29de2ba0268b6616e), [link 2](https://huntr.dev/bounties/7f0481c2-8b57-4324-b47c-795d1ea67e55), [link 3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/)