CVE-2022-2819: Heap-based Buffer Overflow in vim/vim
First published: Mon Aug 15 2022(Updated: )
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211.
Credit: security@huntr.dev security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Vim Vim | <9.0.0211 | |
| Fedoraproject Fedora | =35 | |
| debian/vim | <=2:8.2.2434-3+deb11u1 | 2:9.0.1378-2 2:9.1.0777-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/vim/vim/commit/d1d8f6bacb489036d0fd479c9dd3c0102c988889
- https://huntr.dev/bounties/0a9bd71e-66b8-4eb1-9566-7dfd9b097e59
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHFAR6OY6G77M6GXCJT75A4KITLNR6GO/
- https://security.gentoo.org/glsa/202305-16
- https://launchpad.net/bugs/cve/CVE-2022-2819
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHFAR6OY6G77M6GXCJT75A4KITLNR6GO/
- https://security-tracker.debian.org/tracker/CVE-2022-2819
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2819
- https://nvd.nist.gov/vuln/detail/CVE-2022-2819
- https://ubuntu.com/security/CVE-2022-2819
Frequently Asked Questions
What is CVE-2022-2819?
CVE-2022-2819 is a heap-based buffer overflow vulnerability in the GitHub repository vim/vim prior to version 9.0.0211.
How does CVE-2022-2819 affect Ubuntu?
CVE-2022-2819 affects Ubuntu versions of vim up to and including 2:8.2.3995-1ubuntu2.11.
How does CVE-2022-2819 affect Debian?
CVE-2022-2819 affects Debian versions of vim up to and including 2:8.2.2434-3+deb11u1.
What is the recommended remedy for Ubuntu vim?
The recommended remedy for Ubuntu vim is to update to version 9.0.0211 or later.
What is the recommended remedy for Debian vim?
The recommended remedy for Debian vim is to update to a version higher than 2:8.2.2434-3+deb11u1.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/remedy
- agent/author
- agent/weakness
- agent/description
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/title
- agent/event
- agent/tags
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/usn-cve
- source/Ubuntu
- vendor/vim
- canonical/vim vim
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/35
- package-manager/debian