CVE-2022-2286: Out-of-bounds Read in vim/vim
Last updated 24 July 2024
Other sources
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.0.1378-2+deb12u2Fixed in 2:9.1.1230-1 - Upgrade
Upgrade
vim/vimto a version that resolves this vulnerability.Fixed in 9.0
Event History
Frequently Asked Questions
What is CVE-2022-2286?
CVE-2022-2286 is an out-of-bounds read vulnerability in the GitHub repository vim/vim prior to version 9.0.
What software versions are affected by CVE-2022-2286?
The affected software versions are vim 2:8.0.1453-1ubuntu1.13+ (bionic), vim 2:8.1.2269-1ubuntu5.16 (focal), vim 2:8.2.3995-1ubuntu2.10 (jammy), vim 2:7.4.052-1ubuntu3.1+ (trusty), vim 2:7.4.1689-3ubuntu1.5+ (xenial), and vim 2:9.0.1378-2, 2:9.0.1894-1 (debian).
How severe is CVE-2022-2286?
CVE-2022-2286 is a critical vulnerability with an out-of-bounds read issue.
How can I fix CVE-2022-2286?
To fix CVE-2022-2286, update your vim package to the recommended versions: vim 2:8.0.1453-1ubuntu1.13+ (bionic), vim 2:8.1.2269-1ubuntu5.16 (focal), vim 2:8.2.3995-1ubuntu2.10 (jammy), vim 2:7.4.052-1ubuntu3.1+ (trusty), vim 2:7.4.1689-3ubuntu1.5+ (xenial), or vim 2:9.0.1378-2, 2:9.0.1894-1 (debian) depending on your Linux distribution.
Where can I find more information about CVE-2022-2286?
You can find more information about CVE-2022-2286 on the following references: [Huntr](https://huntr.dev/bounties/fe7681fb-2318-436b-8e65-daf66cd597d8), [GitHub Commit](https://github.com/vim/vim/commit/f12129f1714f7d2301935bb21d896609bdac221c), [Fedora Project](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/).