USN-6965-1: Vim vulnerabilities
It was discovered that vim incorrectly handled parsing of filenames in its search functionality. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service. (CVE-2021-3973) It was discovered that vim incorrectly handled memory when opening and searching the contents of certain files. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. (CVE-2021-3974) It was discovered that vim incorrectly handled memory when opening and editing certain files. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. (CVE-2021-3984, CVE-2021-4019, CVE-2021-4069)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/vimto a version that resolves this vulnerability.Fixed in 2:7.4.052-1ubuntu3.1+esm17
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-6965-1?
The severity of USN-6965-1 is classified as high due to its potential to cause denial of service.
How do I fix USN-6965-1?
To fix USN-6965-1, update the vim package to version 2:7.4.052-1ubuntu3.1+esm17.
What systems are affected by USN-6965-1?
USN-6965-1 affects Ubuntu 14.04 systems running vim version up to 2:7.4.052-1ubuntu3.1+esm17.
What type of vulnerability is USN-6965-1?
USN-6965-1 is a denial of service vulnerability related to improper handling of filenames in vim.
Are there any known exploits for USN-6965-1?
There are no public exploits disclosed for USN-6965-1, but it is critical to patch the vulnerability to prevent potential attacks.