ALAS2022-2022-020

Amazon Linux 2022 Security Advisory: ALAS-2022-020
Advisory Release Date: 2022-01-29 00:36 Pacific
Advisory Updated Date: 2022-02-03 18:40 Pacific
Severity: Medium
Issue Overview:

A flaw was found in vim. The vulnerability occurs due to not checking the length for the NameBuff function, which can lead to a heap buffer overflow. This flaw allows an attacker to input a specially crafted file, leading to a crash or code execution. (CVE-2022-0213)

A heap based out-of-bounds write flaw was found in vim's ops.c. This flaw allows an attacker to trick a user to open a crafted file triggering an out-of-bounds write. This vulnerability is capable of crashing software, modify memory, and possible code execution. (CVE-2022-0261)

A flaw was found in vim. The vulnerability occurs due to reading beyond the end of a line in the utf_head_off function, which can lead to a heap buffer overflow. This flaw allows an attacker to input a specially crafted file, leading to a crash or code execution. (CVE-2022-0318)

Out-of-bounds Read in vim/vim prior to 8.2. (CVE-2022-0319)


Affected Packages:

vim


Issue Correction:
Run dnf update --releasever=2022.0.20220202 vim to update your system.

New Packages:
aarch64:
    vim-X11-debuginfo-8.2.4198-1.amzn2022.aarch64
    vim-minimal-debuginfo-8.2.4198-1.amzn2022.aarch64
    vim-common-debuginfo-8.2.4198-1.amzn2022.aarch64
    vim-debuginfo-8.2.4198-1.amzn2022.aarch64
    vim-enhanced-debuginfo-8.2.4198-1.amzn2022.aarch64
    vim-X11-8.2.4198-1.amzn2022.aarch64
    vim-enhanced-8.2.4198-1.amzn2022.aarch64
    vim-minimal-8.2.4198-1.amzn2022.aarch64
    vim-debugsource-8.2.4198-1.amzn2022.aarch64
    vim-common-8.2.4198-1.amzn2022.aarch64

noarch:
    vim-filesystem-8.2.4198-1.amzn2022.noarch
    vim-default-editor-8.2.4198-1.amzn2022.noarch
    vim-data-8.2.4198-1.amzn2022.noarch

src:
    vim-8.2.4198-1.amzn2022.src

x86_64:
    vim-X11-debuginfo-8.2.4198-1.amzn2022.x86_64
    vim-enhanced-debuginfo-8.2.4198-1.amzn2022.x86_64
    vim-X11-8.2.4198-1.amzn2022.x86_64
    vim-minimal-8.2.4198-1.amzn2022.x86_64
    vim-debuginfo-8.2.4198-1.amzn2022.x86_64
    vim-debugsource-8.2.4198-1.amzn2022.x86_64
    vim-common-debuginfo-8.2.4198-1.amzn2022.x86_64
    vim-enhanced-8.2.4198-1.amzn2022.x86_64
    vim-minimal-debuginfo-8.2.4198-1.amzn2022.x86_64
    vim-common-8.2.4198-1.amzn2022.x86_64

Additional References

Red Hat: CVE-2022-0213, CVE-2022-0261, CVE-2022-0318, CVE-2022-0319

Mitre: CVE-2022-0213, CVE-2022-0261, CVE-2022-0318, CVE-2022-0319