CVE-2022-3099: Use After Free in vim/vim
Last updated 24 July 2024
Other sources
Use After Free in GitHub repository vim/vim prior to 9.0.0360.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.0.1378-2+deb12u2Fixed in 2:9.1.1230-2Fixed in 2:9.1.1230-2+deb13u1Fixed in 2:9.2.0858-1 - Upgrade
Upgrade
alpine/vimto a version that resolves this vulnerability.Fixed in 9.0.0369-r0 - Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.0.0626-1 - Upgrade
Upgrade
vim/vimto a version that resolves this vulnerability.Fixed in 9.0.0360
Event History
Frequently Asked Questions
What is CVE-2022-3099?
CVE-2022-3099 is a vulnerability in the GitHub repository vim/vim prior to version 9.0.0360, which allows for a use after free exploit.
Which software versions are affected by CVE-2022-3099?
The following versions are affected: 2:7.4.052-1ubuntu3.1+, 2:8.0.1453-1ubuntu1.13+, 2:8.1.2269-1ubuntu5.17, 2:8.2.3995-1ubuntu2.11, 2:7.4.1689-3ubuntu1.5+, 2:8.1.0875-5+deb10u5, 2:9.0.1378-2, 2:9.0.1894-1.
What is the severity of CVE-2022-3099?
The severity of CVE-2022-3099 is not specified.
How can I fix CVE-2022-3099?
To fix CVE-2022-3099, update your vim/vim software to version 9.0.0360 or later.
Where can I find more information about CVE-2022-3099?
You can find more information about CVE-2022-3099 at the following references: [Reference 1](https://huntr.dev/bounties/403210c7-6cc7-4874-8934-b57f88bd4f5e), [Reference 2](https://github.com/vim/vim/commit/35d21c6830fc2d68aca838424a0e786821c5891c), [Reference 3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DVWBI4BVTBUMNW4NMB3WZZDQJBKIGXI3/)