CVE-2022-4141: Heap-based Buffer Overflow in vim/vim
Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.0.1378-2+deb12u2Fixed in 2:9.1.1230-2Fixed in 2:9.1.1230-2+deb13u1Fixed in 2:9.2.0858-1 - Upgrade
Upgrade
alpine/vimto a version that resolves this vulnerability.Fixed in 9.0.0999-r0 - Upgrade
Upgrade
debian/vimto a version that resolves this vulnerability.Fixed in 2:9.0.1000-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-4141?
The severity of CVE-2022-4141 is high.
How does CVE-2022-4141 affect Vim and Fedora?
CVE-2022-4141 affects Vim versions 9.0.0946 and below, as well as Fedora versions 36 and 37.
What is the vulnerability type of CVE-2022-4141?
The vulnerability type of CVE-2022-4141 is a heap-based buffer overflow.
How can an attacker exploit CVE-2022-4141?
An attacker can exploit CVE-2022-4141 by using the CTRL-W gf command in the expression used in the RHS of the substitute command in Vim.
How can I fix the vulnerability in Vim and Fedora?
To fix the vulnerability in Vim, update to version 9.0.0947 or later. For Fedora, apply the appropriate security patches or updates.