==========================================================================
Ubuntu Security Notice USN-6270-1
August 03, 2023

vim vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)

Summary:

Several security issues were fixed in Vim.

Software Description:
- vim: Vi IMproved - enhanced vi editor

Details:

It was discovered that Vim incorrectly handled memory when opening certain
files. If an attacker could trick a user into opening a specially crafted
file, it could cause Vim to crash, or possibly execute arbitrary code. This
issue only affected Ubuntu 22.04 LTS. (CVE-2022-2182)

It was discovered that Vim incorrectly handled memory when deleting buffers
in diff mode. An attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2022-2208)

It was discovered that Vim incorrectly handled memory access. An attacker
could possibly use this issue to cause the corruption of sensitive
information, a crash, or arbitrary code execution. This issue only affected
Ubuntu 14.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2022-2210)

It was discovered that Vim incorrectly handled memory when using nested
:source. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-2231)

It was discovered that Vim did not properly perform bounds checks when
processing a menu item with the only modifier. An attacker could possibly
use this issue to cause a denial of service. (CVE-2022-2257)

It was discovered that Vim incorrectly handled memory when opening certain
files. If an attacker could trick a user into opening a specially crafted 
file, it could cause Vim to crash, or possibly execute arbitrary code.
(CVE-2022-2264, CVE-2022-2284, CVE-2022-2289)

It was discovered that Vim did not properly perform bounds checks when
going over the end of the typahead. An attacker could possibly use this
issue to cause a denial of service. (CVE-2022-2285)

It was discovered that Vim did not properly perform bounds checks when
reading the provided string. An attacker could possibly use this issue to
cause a denial of service. (CVE-2022-2286)

It was discovered that Vim incorrectly handled memory when adding words
with a control character to the internal spell word list. An attacker could
possibly use this issue to cause a denial of service. (CVE-2022-2287)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
  vim                             2:8.2.3995-1ubuntu2.10
  vim-athena                      2:8.2.3995-1ubuntu2.10
  vim-gtk                         2:8.2.3995-1ubuntu2.10
  vim-gtk3                        2:8.2.3995-1ubuntu2.10
  vim-nox                         2:8.2.3995-1ubuntu2.10
  vim-tiny                        2:8.2.3995-1ubuntu2.10
  xxd                             2:8.2.3995-1ubuntu2.10

Ubuntu 20.04 LTS:
  vim                             2:8.1.2269-1ubuntu5.16
  vim-athena                      2:8.1.2269-1ubuntu5.16
  vim-gtk                         2:8.1.2269-1ubuntu5.16
  vim-gtk3                        2:8.1.2269-1ubuntu5.16
  vim-nox                         2:8.1.2269-1ubuntu5.16
  vim-tiny                        2:8.1.2269-1ubuntu5.16
  xxd                             2:8.1.2269-1ubuntu5.16

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
  vim                             2:8.0.1453-1ubuntu1.13+esm3
  vim-athena                      2:8.0.1453-1ubuntu1.13+esm3
  vim-gtk                         2:8.0.1453-1ubuntu1.13+esm3
  vim-gtk3                        2:8.0.1453-1ubuntu1.13+esm3
  vim-nox                         2:8.0.1453-1ubuntu1.13+esm3
  vim-tiny                        2:8.0.1453-1ubuntu1.13+esm3
  xxd                             2:8.0.1453-1ubuntu1.13+esm3

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
  vim                             2:7.4.1689-3ubuntu1.5+esm19
  vim-athena                      2:7.4.1689-3ubuntu1.5+esm19
  vim-gtk                         2:7.4.1689-3ubuntu1.5+esm19
  vim-gtk3                        2:7.4.1689-3ubuntu1.5+esm19
  vim-nox                         2:7.4.1689-3ubuntu1.5+esm19
  vim-tiny                        2:7.4.1689-3ubuntu1.5+esm19

Ubuntu 14.04 LTS (Available with Ubuntu Pro):
  vim                             2:7.4.052-1ubuntu3.1+esm11
  vim-athena                      2:7.4.052-1ubuntu3.1+esm11
  vim-gtk                         2:7.4.052-1ubuntu3.1+esm11
  vim-nox                         2:7.4.052-1ubuntu3.1+esm11
  vim-tiny                        2:7.4.052-1ubuntu3.1+esm11

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-6270-1
  CVE-2022-2182, CVE-2022-2208, CVE-2022-2210, CVE-2022-2231,
  CVE-2022-2257, CVE-2022-2264, CVE-2022-2284, CVE-2022-2285,
  CVE-2022-2286, CVE-2022-2287, CVE-2022-2289

Package Information:
  https://launchpad.net/ubuntu/+source/vim/2:8.2.3995-1ubuntu2.10
  https://launchpad.net/ubuntu/+source/vim/2:8.1.2269-1ubuntu5.16

Ubuntu 6270-1: Vim vulnerabilities

August 3, 2023
Several security issues were fixed in Vim.

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) - Ubuntu 14.04 LTS (Available with Ubuntu Pro) Summary: Several security issues were fixed in Vim. Software Description: - vim: Vi IMproved - enhanced vi editor Details: It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-2182) It was discovered that Vim incorrectly handled memory when deleting buffers in diff mode. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-2208) It was discovered that Vim incorrectly handled memory access. An attacker could possibly use this issue to cause the corruption of sensitive information, a crash, or arbitrary code execution. This issue only affected Ubuntu 14.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-2210) It was discovered that Vim incorrectly handled memory when using nested :source. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-2231) It was discovered that Vim did not properly perform bounds checks when processing a menu item with the only modifier. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-2257) It was discovered that Vim incorrectly handled memory when opening certain files. If an attacker could trick a user into opening a specially crafted file, it could cause Vim to crash, or possibly execute arbitrary code. (CVE-2022-2264, CVE-2022-2284, CVE-2022-2289) It was discovered that Vim did not properly perform bounds checks when going over the end of the typahead. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-2285) It was discovered that Vim did not properly perform bounds checks when reading the provided string. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-2286) It was discovered that Vim incorrectly handled memory when adding words with a control character to the internal spell word list. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-2287)

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS: vim 2:8.2.3995-1ubuntu2.10 vim-athena 2:8.2.3995-1ubuntu2.10 vim-gtk 2:8.2.3995-1ubuntu2.10 vim-gtk3 2:8.2.3995-1ubuntu2.10 vim-nox 2:8.2.3995-1ubuntu2.10 vim-tiny 2:8.2.3995-1ubuntu2.10 xxd 2:8.2.3995-1ubuntu2.10 Ubuntu 20.04 LTS: vim 2:8.1.2269-1ubuntu5.16 vim-athena 2:8.1.2269-1ubuntu5.16 vim-gtk 2:8.1.2269-1ubuntu5.16 vim-gtk3 2:8.1.2269-1ubuntu5.16 vim-nox 2:8.1.2269-1ubuntu5.16 vim-tiny 2:8.1.2269-1ubuntu5.16 xxd 2:8.1.2269-1ubuntu5.16 Ubuntu 18.04 LTS (Available with Ubuntu Pro): vim 2:8.0.1453-1ubuntu1.13+esm3 vim-athena 2:8.0.1453-1ubuntu1.13+esm3 vim-gtk 2:8.0.1453-1ubuntu1.13+esm3 vim-gtk3 2:8.0.1453-1ubuntu1.13+esm3 vim-nox 2:8.0.1453-1ubuntu1.13+esm3 vim-tiny 2:8.0.1453-1ubuntu1.13+esm3 xxd 2:8.0.1453-1ubuntu1.13+esm3 Ubuntu 16.04 LTS (Available with Ubuntu Pro): vim 2:7.4.1689-3ubuntu1.5+esm19 vim-athena 2:7.4.1689-3ubuntu1.5+esm19 vim-gtk 2:7.4.1689-3ubuntu1.5+esm19 vim-gtk3 2:7.4.1689-3ubuntu1.5+esm19 vim-nox 2:7.4.1689-3ubuntu1.5+esm19 vim-tiny 2:7.4.1689-3ubuntu1.5+esm19 Ubuntu 14.04 LTS (Available with Ubuntu Pro): vim 2:7.4.052-1ubuntu3.1+esm11 vim-athena 2:7.4.052-1ubuntu3.1+esm11 vim-gtk 2:7.4.052-1ubuntu3.1+esm11 vim-nox 2:7.4.052-1ubuntu3.1+esm11 vim-tiny 2:7.4.052-1ubuntu3.1+esm11 In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6270-1

CVE-2022-2182, CVE-2022-2208, CVE-2022-2210, CVE-2022-2231,

CVE-2022-2257, CVE-2022-2264, CVE-2022-2284, CVE-2022-2285,

CVE-2022-2286, CVE-2022-2287, CVE-2022-2289

Severity
Ubuntu Security Notice USN-6270-1

Package Information

https://launchpad.net/ubuntu/+source/vim/2:8.2.3995-1ubuntu2.10 https://launchpad.net/ubuntu/+source/vim/2:8.1.2269-1ubuntu5.16

Related News

Linux Mint 22: Elevating Security and Usability for Admins
3 - 5 min read
Linux Mint has has long been recognized as a versatile and user-friendly distribution and has earned great popularity among administrators and
Exim 4.98 Addresses Critical Vulnerabilities, Bolsters Email Server Security
2 - 4 min read
Exim is one of Unix-like systems' most widely used mail transfer agents. It's essential for email delivery and handling and is a significant part of
Recent OpenSSH RCE Bug Explained: Impact & Mitigations
2 - 4 min read
In an era where cybersecurity threats loom larger than ever, the discovery of a Remote Code Execution (RCE) vulnerability in OpenSSH by Qualys’
CVE-2024-4577: A Swiftly Weaponized Vulnerability for Ransomware Distribution
2 - 4 min read
Security researchers recently issued an update detailing how attackers are exploiting a PHP code execution vulnerability to spread TellYouThePass
Play Ransomware Group Unleashes New Threat on ESXi Environments: Analysis & Mitigation Strategies
3 - 5 min read
The Play ransomware group, well-known for its double-extortion tactics, recently unveiled a Linux variant targeting ESXi environments. This
Critical Linux Kernel Vulnerabilities Patched in Ubuntu Azure Systems
2 - 4 min read
Canonical has fixed several recently identified critical Linux kernel vulnerabilities in July 2024. These vulnerabilities primarily affect Microsoft
The Urgent Need for Secure Software Development: New Report Serves as a Wake-Up Call for the Industry
3 - 5 min read
The Linux Foundation and Open Source Security Foundation recently published a report entitled "Secure Software Development Education 2024
Severe Linux Kernel Privilege Escalation Bugs Could Compromise Entire Systems
2 - 4 min read
The Cybersecurity and Infrastructure Security Agency (CISA) recently added a new Linux kernel privilege escalation bug ( CVE-2024-1086 ) to its

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved