CVE-2024-22667: Buffer Overflow

Q: What is the severity of CVE-2024-22667?

CVE-2024-22667 is classified as a high severity vulnerability due to its stack-based buffer overflow nature.

Q: How do I fix CVE-2024-22667?

To fix CVE-2024-22667, update Vim to version 9.0.2142 or later.

Q: What versions of Vim are affected by CVE-2024-22667?

CVE-2024-22667 affects all Vim versions before 9.0.2142.

Q: Can CVE-2024-22667 be exploited remotely?

Yes, CVE-2024-22667 can potentially be exploited remotely, allowing for arbitrary code execution.

Q: Which operating systems are impacted by CVE-2024-22667?

CVE-2024-22667 impacts multiple Linux distributions that package vulnerable versions of Vim.

Published Feb 5, 2024

Updated

Vim before 9.0.2142 has a stack-based buffer overflow because didsetlangmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.

Affected Software

11 affected componentsFixes available

debian/vim<=2:8.1.0875-5+deb10u2, <=2:8.1.0875-5+deb10u6, <=2:8.2.2434-3+deb11u1, <=2:9.0.1378-2

2:9.1.0016-12:9.1.0199-1

ubuntu/vim<2:8.0.1453-1ubuntu1.13+

2:8.0.1453-1ubuntu1.13+

ubuntu/vim<2:8.1.2269-1ubuntu5.22

2:8.1.2269-1ubuntu5.22

ubuntu/vim<2:8.2.3995-1ubuntu2.16

2:8.2.3995-1ubuntu2.16

ubuntu/vim<2:9.0.1672-1ubuntu2.3

2:9.0.1672-1ubuntu2.3

ubuntu/vim<2:7.4.052-1ubuntu3.1+

2:7.4.052-1ubuntu3.1+

ubuntu/vim<2:9.0.2189-1

2:9.0.2189-1

ubuntu/vim<2:7.4.1689-3ubuntu1.5+

2:7.4.1689-3ubuntu1.5+

vim Vim<9.0.2142

Fedoraproject Fedora=38

Fedoraproject Fedora=39

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/vim to a version that resolves this vulnerability.
Fixed in 2:9.1.0016-1Fixed in 2:9.1.0199-1
Upgrade
Upgrade ubuntu/vim to a version that resolves this vulnerability.
Fixed in 2:8.0.1453-1ubuntu1.13+
Upgrade
Upgrade ubuntu/vim to a version that resolves this vulnerability.
Fixed in 2:8.1.2269-1ubuntu5.22
Upgrade
Upgrade ubuntu/vim to a version that resolves this vulnerability.
Fixed in 2:8.2.3995-1ubuntu2.16
Upgrade
Upgrade ubuntu/vim to a version that resolves this vulnerability.
Fixed in 2:9.0.1672-1ubuntu2.3
Upgrade
Upgrade ubuntu/vim to a version that resolves this vulnerability.
Fixed in 2:7.4.052-1ubuntu3.1+
Upgrade
Upgrade ubuntu/vim to a version that resolves this vulnerability.
Fixed in 2:9.0.2189-1
Upgrade
Upgrade ubuntu/vim to a version that resolves this vulnerability.
Fixed in 2:7.4.1689-3ubuntu1.5+

Event History

Feb 5, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Mar 18, 2024

Data Sourced

via Launchpad·07:12 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

USN-6698-1

Frequently Asked Questions

What is the severity of CVE-2024-22667?

CVE-2024-22667 is classified as a high severity vulnerability due to its stack-based buffer overflow nature.

How do I fix CVE-2024-22667?