Tech Support
Documentation
Login
Contact Us
Vim Vulnerabilities Addressed in Ubuntu Security Updates
Rohan Timalsina
October 17, 2023 - TuxCare expert team
The recent Ubuntu security updates have addressed 13 vulnerabilities in the Vim package. Canonical has released updates for different Ubuntu releases, including Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 ESM, and Ubuntu 14.04 ESM. In this blog, we will look at some of the Vim vulnerabilities that have been patched in the update.
Several Vim Vulnerabilities Fixed
CVE-2022-3234
CVSS 3.x Score: 7.8 (High)
Vim did not correctly handle memory when replacing it in virtualedit mode, leading to a heap-based buffer overflow. An attacker can use this to cause a denial of service. Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS are only affected.
CVE-2022-3256
CVSS 3.x Score: 7.8 High
It was found that Vim did not correctly handle memory when autocmd changes mark. An attacker can use this use-after-free flaw to cause a denial of service.
CVE-2022-3324
CVSS 3.x Score: 7.8 High
Vim did not correctly perform checks on the array index with the negative width window. An attacker can use this stack-based buffer overflow vulnerability to cause a denial of service or execute arbitrary code.
CVE-2022-3520
CVSS 3.x Score: 9.8 Critical
It was discovered that Vim did not properly perform checks on a put command column with a visual block. An attacker could possibly use this heap-based buffer overflow issue to cause a denial of service. Ubuntu 20.04 LTS and Ubuntu 22.04 LTS are only affected.
CVE-2022-3591
CVSS 3.x Score: 7.8 High
Vim did not correctly handle memory when using autocommand to open a window. An attacker can use this use-after-free flaw to cause a denial of service.
CVE-2022-3705
CVSS 3.x Score: 7.5 High
A vulnerability was detected in Vim and has been categorized as problematic. This issue pertains to the function qf_update_buffer within the file quickfix.c of the autocmd Handler component. Exploiting this vulnerability can result in a use-after-free condition, and it may be exploited remotely. A potential attacker could leverage this vulnerability to initiate a denial of service. It’s important to note that this issue only impacted Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
CVE-2022-4293
CVSS 3.x Score: 5.5 Medium
Vim did not correctly handle floating point comparison with the incorrect operating, resulting in a floating point exception flaw. An attacker can use this issue to cause a denial of service. Ubuntu 20.04 LTS and Ubuntu 22.04 LTS are only affected.
TuxCare has already released patches for these vulnerabilities affecting different EOL Linux distributions. Learn about Extended Lifecycle Support for End-of-Life Linux.
Final Thoughts
It is highly recommended to update the system to newer package versions to fix these Vim vulnerabilities. A reboot will be required after the system update.
To apply patches without a system reboot, you can consider using TuxCare’s KernelCare Enterprise, which provides an automated live patching solution to apply security updates to Linux systems. Learn how live patching works with KernelCare.
The sources for this article can be found on Ubuntu Security Notices.
