CVE-2022-2343: Heap-based Buffer Overflow in vim/vim

Q: What user interaction is required for exploitation?

The CVSS vector indicates user interaction is required. An attacker would need a user to interact with malicious content in Vim; the provided data does not specify the exact interaction.

Q: Is this remotely exploitable?

The CVSS vector lists local attack vector (AV:L). The provided data does not indicate network-based exploitation.

Q: Which versions need to be remediated?

Vim versions prior to 9.0.0044 are affected. A patch is available.

Published Jul 8, 2022

Updated

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044.

Affected Software

2 affected components

vim Vim<9.0.0044

Fedoraproject Fedora=35

Remediation

Patch Available

https://github.com/vim/vim/commit/caea66442d86e7bbba3bf3dc202c3c0d549b9853

Patch Available

https://huntr.dev/bounties/2ecb4345-2fc7-4e7f-adb0-83a20bb458f5

Event History

Jul 8, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What user interaction is required for exploitation?

The CVSS vector indicates user interaction is required. An attacker would need a user to interact with malicious content in Vim; the provided data does not specify the exact interaction.

Is this remotely exploitable?

The CVSS vector lists local attack vector (AV:L). The provided data does not indicate network-based exploitation.

Which versions need to be remediated?

Vim versions prior to 9.0.0044 are affected. A patch is available.

CVE-2022-2343: Heap-based Buffer Overflow in vim/vim

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

What user interaction is required for exploitation?

Is this remotely exploitable?

Which versions need to be remediated?

Company

Resources

Contact

Frequently Asked Questions

What user interaction is required for exploitation?

Is this remotely exploitable?

Which versions need to be remediated?