ALAS2022-2021-001


Amazon Linux 2022 Security Advisory: ALAS-2021-001
Advisory Release Date: 2021-10-26 02:25 Pacific
Advisory Updated Date: 2021-10-27 00:24 Pacific
Severity: Medium

Issue Overview:

A flaw was found in vim. A possible heap-based buffer overflow could allow an attacker to input a specially crafted file leading to a crash or code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2021-3778)

A use-after-free vulnerability in vim could allow an attacker to input a specially crafted file leading to memory corruption and a potentially exploitable crash or code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2021-3796)

An out-of-bounds write flaw was found in vim's drawscreen.c win_redr_status() function. This flaw allows an attacker to trick a user to open a crafted file with specific arguments in vim, triggering an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, and system availability. (CVE-2021-3872)

There's an out-of-bounds read flaw in Vim's ex_docmd.c. An attacker who is capable of tricking a user into opening a specially crafted file could trigger an out-of-bounds read on a memmove operation, potentially causing an impact to application availability. (CVE-2021-3875)


Affected Packages:

vim


Issue Correction:
Run yum update vim to update your system.

New Packages:
aarch64:
    vim-X11-debuginfo-8.2.3512-1.amzn2022.aarch64
    vim-common-debuginfo-8.2.3512-1.amzn2022.aarch64
    vim-debuginfo-8.2.3512-1.amzn2022.aarch64
    vim-enhanced-debuginfo-8.2.3512-1.amzn2022.aarch64
    vim-enhanced-8.2.3512-1.amzn2022.aarch64
    vim-minimal-8.2.3512-1.amzn2022.aarch64
    vim-X11-8.2.3512-1.amzn2022.aarch64
    vim-minimal-debuginfo-8.2.3512-1.amzn2022.aarch64
    vim-debugsource-8.2.3512-1.amzn2022.aarch64
    vim-common-8.2.3512-1.amzn2022.aarch64

i686:
    vim-enhanced-debuginfo-8.2.3512-1.amzn2022.i686
    vim-X11-debuginfo-8.2.3512-1.amzn2022.i686
    vim-debugsource-8.2.3512-1.amzn2022.i686
    vim-common-8.2.3512-1.amzn2022.i686
    vim-X11-8.2.3512-1.amzn2022.i686
    vim-enhanced-8.2.3512-1.amzn2022.i686
    vim-minimal-debuginfo-8.2.3512-1.amzn2022.i686
    vim-minimal-8.2.3512-1.amzn2022.i686
    vim-debuginfo-8.2.3512-1.amzn2022.i686
    vim-common-debuginfo-8.2.3512-1.amzn2022.i686

noarch:
    vim-default-editor-8.2.3512-1.amzn2022.noarch
    vim-filesystem-8.2.3512-1.amzn2022.noarch

src:
    vim-8.2.3512-1.amzn2022.src

x86_64:
    vim-X11-debuginfo-8.2.3512-1.amzn2022.x86_64
    vim-common-debuginfo-8.2.3512-1.amzn2022.x86_64
    vim-debugsource-8.2.3512-1.amzn2022.x86_64
    vim-minimal-8.2.3512-1.amzn2022.x86_64
    vim-debuginfo-8.2.3512-1.amzn2022.x86_64
    vim-minimal-debuginfo-8.2.3512-1.amzn2022.x86_64
    vim-enhanced-8.2.3512-1.amzn2022.x86_64
    vim-enhanced-debuginfo-8.2.3512-1.amzn2022.x86_64
    vim-X11-8.2.3512-1.amzn2022.x86_64
    vim-common-8.2.3512-1.amzn2022.x86_64