Important: vim

Issue Overview:

A heap buffer overflow vulnerability was found in vim’s ins_compl_infercase_gettext() function of the src/insexpand.c file. This flaw occurs when vim tries to access uninitialized memory when completing a long line. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering a heap-based buffer overflow that causes an application to crash, possibly executing code and corrupting memory. (CVE-2022-2522)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220. (CVE-2022-2849)

Use After Free in GitHub repository vim/vim prior to 9.0.0221. (CVE-2022-2862)

A heap use-after-free vulnerability was found in vim’s qf_fill_buffer() function of the src/quickfix.c file. The issue occurs because vim uses freed memory when recursively using ‘quickfixtextfunc.’ This flaw allows an attacker to trick a user into opening a specially crafted file, triggering a heap use-after-free that causes an application to crash, possibly executing code and corrupting memory. (CVE-2022-2982)

A heap use-after-free vulnerability was found in vim’s get_next_valid_entry() function of the src/quickfix.c file. The issue occurs because vim is using freed memory when the location list is changed in autocmd. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering a heap use-after-free that causes an application to crash, possibly executing code and corrupting memory. (CVE-2022-3016)

Use After Free in GitHub repository vim/vim prior to 9.0.0530. (CVE-2022-3256)

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598. (CVE-2022-3324)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742. (CVE-2022-3491)

A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thru 9.0.0339 allows attackers to cause denial of service or other unspecified impacts. (CVE-2022-47024)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. (CVE-2023-0051)

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. (CVE-2023-0054)

A heap-based buffer overflow vulnerability was found in GitHub repository vim/vim prior to 9.0.1376 in Vim’s utf_ptr2char() function of the src/mbyte.c file. This flaw occurs because there is access to invalid memory with put in visual block mode. An attacker can trick a user into opening a specially crafted file, triggering an out-of-bounds read that causes an application to crash, leading to a denial of service. (CVE-2023-1170)

Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378. (CVE-2023-1175)

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392. (CVE-2023-1264)

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402. (CVE-2023-1355)

Affected Packages:

vim

Issue Correction:
Run yum update vim to update your system.

New Packages:

i686:  
    vim-common-9.0.1403-1.76.amzn1.i686  
    vim-enhanced-9.0.1403-1.76.amzn1.i686  
    vim-minimal-9.0.1403-1.76.amzn1.i686  
    vim-debuginfo-9.0.1403-1.76.amzn1.i686  
  
noarch:  
    vim-filesystem-9.0.1403-1.76.amzn1.noarch  
    vim-data-9.0.1403-1.76.amzn1.noarch  
  
src:  
    vim-9.0.1403-1.76.amzn1.src  
  
x86_64:  
    vim-enhanced-9.0.1403-1.76.amzn1.x86_64  
    vim-minimal-9.0.1403-1.76.amzn1.x86_64  
    vim-common-9.0.1403-1.76.amzn1.x86_64  
    vim-debuginfo-9.0.1403-1.76.amzn1.x86_64  

Additional References

Red Hat: CVE-2022-2522, CVE-2022-2849, CVE-2022-2862, CVE-2022-2982, CVE-2022-3016, CVE-2022-3256, CVE-2022-3324, CVE-2022-3491, CVE-2022-47024, CVE-2023-0051, CVE-2023-0054, CVE-2023-1170, CVE-2023-1175, CVE-2023-1264, CVE-2023-1355

Mitre: CVE-2022-2522, CVE-2022-2849, CVE-2022-2862, CVE-2022-2982, CVE-2022-3016, CVE-2022-3256, CVE-2022-3324, CVE-2022-3491, CVE-2022-47024, CVE-2023-0051, CVE-2023-0054, CVE-2023-1170, CVE-2023-1175, CVE-2023-1264, CVE-2023-1355