=========================================================================Ubuntu Security Notice USN-5433-1
May 23, 2022

vim vulnerabilities
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 16.04 ESM

Summary:

Several security issues were fixed in Vim.

Software Description:
- vim: Vi IMproved - enhanced vi editor

Details:

It was discovered that Vim incorrectly handled parsing of filenames in its
search functionality. If a user were tricked into opening a specially 
crafted
file, an attacker could crash the application, leading to a denial of
service. (CVE-2021-3973)

It was discovered that Vim incorrectly handled memory when opening and
searching the contents of certain files. If a user were tricked into opening
a specially crafted file, an attacker could crash the application, 
leading to
a denial of service, or possibly achieve code execution with user 
privileges.
(CVE-2021-3974)

It was discovered that Vim incorrectly handled memory when opening and
editing certain files. If a user were tricked into opening a specially 
crafted file,
an attacker could crash the application, leading to a denial of service, or
possibly achieve code execution with user privileges. (CVE-2021-3984,
CVE-2021-4019, CVE-2021-4069)

It was discovered that Vim was using freed memory when dealing with regular
expressions inside a visual selection. If a user were tricked into opening a
specially crafted file, an attacker could crash the application, leading 
to a
denial of service, or possibly achieve code execution with user privileges.
(CVE-2021-4192)

It was discovered that Vim was incorrectly performing read and write
operations when in visual block mode, going beyond the end of a line and
causing a heap buffer overflow. If a user were tricked into opening a
specially crafted file, an attacker could crash the application, leading 
to a
denial of service, or possibly achieve code execution with user privileges.
(CVE-2022-0261, CVE-2022-0318)

It was discovered that Vim was using freed memory when dealing with regular
expressions through its old regular expression engine. If a user were 
tricked
into opening a specially crafted file, an attacker could crash the 
application,
leading to a denial of service, or possibly achieve code execution with user
privileges. (CVE-2022-1154)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 ESM:
   vim                             2:7.4.1689-3ubuntu1.5+esm4

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-5433-1
   CVE-2021-3973, CVE-2021-3974, CVE-2021-3984, CVE-2021-4019,
   CVE-2021-4069, CVE-2021-4192, CVE-2022-0261, CVE-2022-0318,
   CVE-2022-1154