Описание
Security update for vim
This update for vim fixes the following issues:
- CVE-2017-17087: Fixed information leak via .swp files (bsc#1070955).
- CVE-2021-3875: Fixed heap-based buffer overflow (bsc#1191770).
- CVE-2021-3903: Fixed heap-based buffer overflow (bsc#1192167).
- CVE-2021-3968: Fixed heap-based buffer overflow (bsc#1192902).
- CVE-2021-3973: Fixed heap-based buffer overflow (bsc#1192903).
- CVE-2021-3974: Fixed use-after-free (bsc#1192904).
- CVE-2021-4069: Fixed use-after-free in ex_open()in src/ex_docmd.c (bsc#1193466).
- CVE-2021-4136: Fixed heap-based buffer overflow (bsc#1193905).
- CVE-2021-4166: Fixed out-of-bounds read (bsc#1194093).
- CVE-2021-4192: Fixed use-after-free (bsc#1194217).
- CVE-2021-4193: Fixed out-of-bounds read (bsc#1194216).
- CVE-2022-0128: Fixed out-of-bounds read (bsc#1194388).
- CVE-2022-0213: Fixed heap-based buffer overflow (bsc#1194885).
- CVE-2022-0261: Fixed heap-based buffer overflow (bsc#1194872).
- CVE-2022-0318: Fixed heap-based buffer overflow (bsc#1195004).
- CVE-2022-0359: Fixed heap-based buffer overflow in init_ccline() in ex_getln.c (bsc#1195203).
- CVE-2022-0392: Fixed heap-based buffer overflow (bsc#1195332).
- CVE-2022-0407: Fixed heap-based buffer overflow (bsc#1195354).
- CVE-2022-0696: Fixed NULL pointer dereference (bsc#1196361).
- CVE-2022-1381: Fixed global heap buffer overflow in skip_range (bsc#1198596).
- CVE-2022-1420: Fixed out-of-range pointer offset (bsc#1198748).
- CVE-2022-1616: Fixed use-after-free in append_command (bsc#1199331).
- CVE-2022-1619: Fixed heap-based Buffer Overflow in function cmdline_erase_chars (bsc#1199333).
- CVE-2022-1620: Fixed NULL pointer dereference in function vim_regexec_string (bsc#1199334).
- CVE-2022-1733: Fixed heap-based buffer overflow in cindent.c (bsc#1199655).
- CVE-2022-1735: Fixed heap-based buffer overflow (bsc#1199651).
- CVE-2022-1771: Fixed stack exhaustion (bsc#1199693).
- CVE-2022-1785: Fixed out-of-bounds write (bsc#1199745).
- CVE-2022-1796: Fixed use-after-free in find_pattern_in_path (bsc#1199747).
- CVE-2022-1851: Fixed out-of-bounds read (bsc#1199936).
- CVE-2022-1897: Fixed out-of-bounds write (bsc#1200010).
- CVE-2022-1898: Fixed use-after-free (bsc#1200011).
- CVE-2022-1927: Fixed buffer over-read (bsc#1200012).
Список пакетов
Container ses/7.1/ceph/haproxy:latest
Container suse/sle-micro-rancher/5.2:latest
Container suse/sle-micro-rancher/5.3:latest
Container suse/sle-micro-rancher/5.4:latest
Container suse/sle-micro/5.1/toolbox:latest
Container suse/sle-micro/5.2/toolbox:latest
Container suse/sle-micro/5.3/toolbox:latest
Container suse/sle-micro/5.4/toolbox:latest
Image SLES15-SP1-CHOST-BYOS-Azure
Image SLES15-SP1-CHOST-BYOS-EC2
Image SLES15-SP1-CHOST-BYOS-GCE
Image SLES15-SP1-SAP-Azure-LI-BYOS-Production
Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production
Image SLES15-SP1-SAPCAL-Azure
Image SLES15-SP1-SAPCAL-EC2-HVM
Image SLES15-SP1-SAPCAL-GCE
Image SLES15-SP2-BYOS-Azure
Image SLES15-SP2-BYOS-EC2-HVM
Image SLES15-SP2-BYOS-GCE
Image SLES15-SP2-CHOST-BYOS-Aliyun
Image SLES15-SP2-CHOST-BYOS-Azure
Image SLES15-SP2-CHOST-BYOS-EC2
Image SLES15-SP2-CHOST-BYOS-GCE
Image SLES15-SP2-HPC-BYOS-Azure
Image SLES15-SP2-HPC-BYOS-EC2-HVM
Image SLES15-SP2-SAP-Azure
Image SLES15-SP2-SAP-Azure-LI-BYOS-Production
Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production
Image SLES15-SP2-SAP-BYOS-Azure
Image SLES15-SP2-SAP-BYOS-EC2-HVM
Image SLES15-SP2-SAP-BYOS-GCE
Image SLES15-SP2-SAP-EC2-HVM
Image SLES15-SP2-SAP-GCE
Image SLES15-SP3-BYOS-Azure
Image SLES15-SP3-BYOS-EC2-HVM
Image SLES15-SP3-BYOS-GCE
Image SLES15-SP3-CHOST-BYOS-Aliyun
Image SLES15-SP3-CHOST-BYOS-Azure
Image SLES15-SP3-CHOST-BYOS-EC2
Image SLES15-SP3-CHOST-BYOS-GCE
Image SLES15-SP3-CHOST-BYOS-SAP-CCloud
Image SLES15-SP3-HPC-BYOS-Azure
Image SLES15-SP3-HPC-BYOS-EC2-HVM
Image SLES15-SP3-HPC-BYOS-GCE
Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure
Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM
Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE
Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure
Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM
Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE
Image SLES15-SP3-Micro-5-1-BYOS-Azure
Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM
Image SLES15-SP3-Micro-5-1-BYOS-GCE
Image SLES15-SP3-Micro-5-2-BYOS-Azure
Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM
Image SLES15-SP3-Micro-5-2-BYOS-GCE
Image SLES15-SP3-SAP-Azure-LI-BYOS-Production
Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production
Image SLES15-SP3-SAP-BYOS-Azure
Image SLES15-SP3-SAP-BYOS-EC2-HVM
Image SLES15-SP3-SAP-BYOS-GCE
Image SLES15-SP3-SAPCAL-Azure
Image SLES15-SP3-SAPCAL-EC2-HVM
Image SLES15-SP3-SAPCAL-GCE
Image SLES15-SP4
Image SLES15-SP4-Azure-Basic
Image SLES15-SP4-Azure-Standard
Image SLES15-SP4-BYOS
Image SLES15-SP4-BYOS-Azure
Image SLES15-SP4-BYOS-EC2
Image SLES15-SP4-BYOS-GCE
Image SLES15-SP4-CHOST-BYOS
Image SLES15-SP4-CHOST-BYOS-Aliyun
Image SLES15-SP4-CHOST-BYOS-Azure
Image SLES15-SP4-CHOST-BYOS-EC2
Image SLES15-SP4-CHOST-BYOS-GCE
Image SLES15-SP4-CHOST-BYOS-SAP-CCloud
Image SLES15-SP4-EC2
Image SLES15-SP4-EC2-ECS-HVM
Image SLES15-SP4-GCE
Image SLES15-SP4-HPC
Image SLES15-SP4-HPC-Azure
Image SLES15-SP4-HPC-BYOS
Image SLES15-SP4-HPC-BYOS-Azure
Image SLES15-SP4-HPC-BYOS-EC2
Image SLES15-SP4-HPC-BYOS-GCE
Image SLES15-SP4-HPC-EC2
Image SLES15-SP4-HPC-GCE
Image SLES15-SP4-Hardened-BYOS
Image SLES15-SP4-Hardened-BYOS-Azure
Image SLES15-SP4-Hardened-BYOS-EC2
Image SLES15-SP4-Hardened-BYOS-GCE
Image SLES15-SP4-Manager-Proxy-4-3-BYOS
Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure
Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2
Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE
Image SLES15-SP4-Manager-Server-4-3
Image SLES15-SP4-Manager-Server-4-3-Azure-llc
Image SLES15-SP4-Manager-Server-4-3-Azure-ltd
Image SLES15-SP4-Manager-Server-4-3-BYOS
Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure
Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2
Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE
Image SLES15-SP4-Manager-Server-4-3-EC2-llc
Image SLES15-SP4-Manager-Server-4-3-EC2-ltd
Image SLES15-SP4-Micro-5-3
Image SLES15-SP4-Micro-5-3-Azure
Image SLES15-SP4-Micro-5-3-BYOS
Image SLES15-SP4-Micro-5-3-BYOS-Azure
Image SLES15-SP4-Micro-5-3-BYOS-EC2
Image SLES15-SP4-Micro-5-3-BYOS-GCE
Image SLES15-SP4-Micro-5-3-EC2
Image SLES15-SP4-Micro-5-3-GCE
Image SLES15-SP4-Micro-5-4
Image SLES15-SP4-Micro-5-4-Azure
Image SLES15-SP4-Micro-5-4-BYOS
Image SLES15-SP4-Micro-5-4-BYOS-Azure
Image SLES15-SP4-Micro-5-4-BYOS-EC2
Image SLES15-SP4-Micro-5-4-BYOS-GCE
Image SLES15-SP4-Micro-5-4-EC2
Image SLES15-SP4-Micro-5-4-GCE
Image SLES15-SP4-SAP
Image SLES15-SP4-SAP-Azure
Image SLES15-SP4-SAP-Azure-LI-BYOS
Image SLES15-SP4-SAP-Azure-LI-BYOS-Production
Image SLES15-SP4-SAP-Azure-VLI-BYOS
Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production
Image SLES15-SP4-SAP-BYOS
Image SLES15-SP4-SAP-BYOS-Azure
Image SLES15-SP4-SAP-BYOS-EC2
Image SLES15-SP4-SAP-BYOS-GCE
Image SLES15-SP4-SAP-EC2
Image SLES15-SP4-SAP-GCE
Image SLES15-SP4-SAP-Hardened
Image SLES15-SP4-SAP-Hardened-Azure
Image SLES15-SP4-SAP-Hardened-BYOS
Image SLES15-SP4-SAP-Hardened-BYOS-Azure
Image SLES15-SP4-SAP-Hardened-BYOS-EC2
Image SLES15-SP4-SAP-Hardened-BYOS-GCE
Image SLES15-SP4-SAP-Hardened-EC2
Image SLES15-SP4-SAP-Hardened-GCE
Image SLES15-SP4-SAPCAL
Image SLES15-SP4-SAPCAL-Azure
Image SLES15-SP4-SAPCAL-EC2
Image SLES15-SP4-SAPCAL-GCE
Image SLES15-SP4-SUSE-Rancher-Setup-BYOS
Image SLES15-SP4-SUSE-Rancher-Setup-BYOS-EC2
Image SLES15-SP4-SUSE-Rancher-Setup-BYOS-EC2-HVM
SUSE Enterprise Storage 6
SUSE Enterprise Storage 7
SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS
SUSE Linux Enterprise High Performance Computing 15-ESPOS
SUSE Linux Enterprise High Performance Computing 15-LTSS
SUSE Linux Enterprise Micro 5.1
SUSE Linux Enterprise Micro 5.2
SUSE Linux Enterprise Module for Basesystem 15 SP3
SUSE Linux Enterprise Module for Basesystem 15 SP4
SUSE Linux Enterprise Module for Desktop Applications 15 SP3
SUSE Linux Enterprise Module for Desktop Applications 15 SP4
SUSE Linux Enterprise Server 15 SP1-BCL
SUSE Linux Enterprise Server 15 SP1-LTSS
SUSE Linux Enterprise Server 15 SP2-BCL
SUSE Linux Enterprise Server 15 SP2-LTSS
SUSE Linux Enterprise Server 15-LTSS
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server for SAP Applications 15 SP1
SUSE Linux Enterprise Server for SAP Applications 15 SP2
SUSE Manager Proxy 4.1
SUSE Manager Retail Branch Server 4.1
SUSE Manager Server 4.1
openSUSE Leap 15.3
openSUSE Leap 15.4
Ссылки
- Link for SUSE-SU-2022:2102-1
- E-Mail link for SUSE-SU-2022:2102-1
- SUSE Security Ratings
- SUSE Bug 1070955
- SUSE Bug 1191770
- SUSE Bug 1192167
- SUSE Bug 1192902
- SUSE Bug 1192903
- SUSE Bug 1192904
- SUSE Bug 1193466
- SUSE Bug 1193905
- SUSE Bug 1194093
- SUSE Bug 1194216
- SUSE Bug 1194217
- SUSE Bug 1194388
- SUSE Bug 1194872
- SUSE Bug 1194885
- SUSE Bug 1195004
- SUSE Bug 1195203
- SUSE Bug 1195332
Описание
fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the group ownership of the original file), which allows local users to obtain sensitive information by leveraging an applicable group membership, as demonstrated by /etc/shadow owned by root:shadow mode 0640, but /etc/.shadow.swp owned by root:users mode 0640, a different vulnerability than CVE-2017-1000382.
Затронутые продукты
Ссылки
- CVE-2017-17087
- SUSE Bug 1065958
- SUSE Bug 1070955
Описание
vim is vulnerable to Heap-based Buffer Overflow
Затронутые продукты
Ссылки
- CVE-2021-3778
- SUSE Bug 1190533
Описание
vim is vulnerable to Use After Free
Затронутые продукты
Ссылки
- CVE-2021-3796
- SUSE Bug 1190570
Описание
vim is vulnerable to Heap-based Buffer Overflow
Затронутые продукты
Ссылки
- CVE-2021-3872
- SUSE Bug 1191893
Описание
vim is vulnerable to Heap-based Buffer Overflow
Затронутые продукты
Ссылки
- CVE-2021-3875
- SUSE Bug 1191770
- SUSE Bug 1208651
Описание
vim is vulnerable to Heap-based Buffer Overflow
Затронутые продукты
Ссылки
- CVE-2021-3903
- SUSE Bug 1192167
Описание
vim is vulnerable to Heap-based Buffer Overflow
Затронутые продукты
Ссылки
- CVE-2021-3927
- SUSE Bug 1192481
Описание
vim is vulnerable to Use of Uninitialized Variable
Затронутые продукты
Ссылки
- CVE-2021-3928
- SUSE Bug 1192478
Описание
vim is vulnerable to Heap-based Buffer Overflow
Затронутые продукты
Ссылки
- CVE-2021-3968
- SUSE Bug 1192902
- SUSE Bug 1208308
- SUSE Bug 1208649
- SUSE Bug 1208651
Описание
vim is vulnerable to Heap-based Buffer Overflow
Затронутые продукты
Ссылки
- CVE-2021-3973
- SUSE Bug 1192903
- SUSE Bug 1208308
- SUSE Bug 1208649
- SUSE Bug 1208651
Описание
vim is vulnerable to Use After Free
Затронутые продукты
Ссылки
- CVE-2021-3974
- SUSE Bug 1192904
- SUSE Bug 1206818
- SUSE Bug 1208308
- SUSE Bug 1208651
Описание
vim is vulnerable to Heap-based Buffer Overflow
Затронутые продукты
Ссылки
- CVE-2021-3984
- SUSE Bug 1193298
Описание
vim is vulnerable to Heap-based Buffer Overflow
Затронутые продукты
Ссылки
- CVE-2021-4019
- SUSE Bug 1193294
Описание
vim is vulnerable to Use After Free
Затронутые продукты
Ссылки
- CVE-2021-4069
- SUSE Bug 1193466
Описание
vim is vulnerable to Heap-based Buffer Overflow
Затронутые продукты
Ссылки
- CVE-2021-4136
- SUSE Bug 1193905
- SUSE Bug 1208308
- SUSE Bug 1208649
- SUSE Bug 1208651
Описание
vim is vulnerable to Out-of-bounds Read
Затронутые продукты
Ссылки
- CVE-2021-4166
- SUSE Bug 1194093
Описание
vim is vulnerable to Use After Free
Затронутые продукты
Ссылки
- CVE-2021-4192
- SUSE Bug 1194217
Описание
vim is vulnerable to Out-of-bounds Read
Затронутые продукты
Ссылки
- CVE-2021-4193
- SUSE Bug 1194216
Описание
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Затронутые продукты
Ссылки
- CVE-2021-46059
- SUSE Bug 1194556
Описание
vim is vulnerable to Out-of-bounds Read
Затронутые продукты
Ссылки
- CVE-2022-0128
- SUSE Bug 1194388
Описание
vim is vulnerable to Heap-based Buffer Overflow
Затронутые продукты
Ссылки
- CVE-2022-0213
- SUSE Bug 1194885
Описание
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Затронутые продукты
Ссылки
- CVE-2022-0261
- SUSE Bug 1194872
Описание
Heap-based Buffer Overflow in vim/vim prior to 8.2.
Затронутые продукты
Ссылки
- CVE-2022-0318
- SUSE Bug 1195004
Описание
Out-of-bounds Read in vim/vim prior to 8.2.
Затронутые продукты
Ссылки
- CVE-2022-0319
- SUSE Bug 1195066
Описание
Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.
Затронутые продукты
Ссылки
- CVE-2022-0351
- SUSE Bug 1195126
Описание
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Затронутые продукты
Ссылки
- CVE-2022-0359
- SUSE Bug 1195203
Описание
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Затронутые продукты
Ссылки
- CVE-2022-0361
- SUSE Bug 1195202
Описание
Heap-based Buffer Overflow in GitHub repository vim prior to 8.2.
Затронутые продукты
Ссылки
- CVE-2022-0392
- SUSE Bug 1195332
Описание
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Затронутые продукты
Ссылки
- CVE-2022-0407
- SUSE Bug 1195354
- SUSE Bug 1208308
- SUSE Bug 1208649
- SUSE Bug 1208651
Описание
Use After Free in GitHub repository vim/vim prior to 8.2.
Затронутые продукты
Ссылки
- CVE-2022-0413
- SUSE Bug 1195356
- SUSE Bug 1208308
- SUSE Bug 1208651
Описание
NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4428.
Затронутые продукты
Ссылки
- CVE-2022-0696
- SUSE Bug 1196361
- SUSE Bug 1205395
Описание
global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
Затронутые продукты
Ссылки
- CVE-2022-1381
- SUSE Bug 1198596
Описание
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774.
Затронутые продукты
Ссылки
- CVE-2022-1420
- SUSE Bug 1198748
Описание
Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
Затронутые продукты
Ссылки
- CVE-2022-1616
- SUSE Bug 1199331
Описание
Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution
Затронутые продукты
Ссылки
- CVE-2022-1619
- SUSE Bug 1199333
Описание
NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash) via a crafted input.
Затронутые продукты
Ссылки
- CVE-2022-1620
- SUSE Bug 1199334
Описание
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4968.
Затронутые продукты
Ссылки
- CVE-2022-1733
- SUSE Bug 1199655
Описание
Classic Buffer Overflow in GitHub repository vim/vim prior to 8.2.4969.
Затронутые продукты
Ссылки
- CVE-2022-1735
- SUSE Bug 1199651
Описание
Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975.
Затронутые продукты
Ссылки
- CVE-2022-1771
- SUSE Bug 1199693
Описание
Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.4977.
Затронутые продукты
Ссылки
- CVE-2022-1785
- SUSE Bug 1199745
Описание
Use After Free in GitHub repository vim/vim prior to 8.2.4979.
Затронутые продукты
Ссылки
- CVE-2022-1796
- SUSE Bug 1199747
Описание
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
Затронутые продукты
Ссылки
- CVE-2022-1851
- SUSE Bug 1199936
Описание
Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
Затронутые продукты
Ссылки
- CVE-2022-1897
- SUSE Bug 1200010
Описание
Use After Free in GitHub repository vim/vim prior to 8.2.
Затронутые продукты
Ссылки
- CVE-2022-1898
- SUSE Bug 1200011
Описание
Buffer Over-read in GitHub repository vim/vim prior to 8.2.
Затронутые продукты
Ссылки
- CVE-2022-1927
- SUSE Bug 1200012