{"id":"USN-5458-1","summary":"vim vulnerabilities","details":"It was discovered that Vim was incorrectly handling virtual column\nposition operations, which could result in an out-of-bounds read. An\nattacker could possibly use this issue to expose sensitive\ninformation. (CVE-2021-4193)\n\nIt was discovered that Vim was not properly performing bounds checks\nwhen updating windows present on a screen, which could result in a\nheap buffer overflow. An attacker could possibly use this issue to\ncause a denial of service or execute arbitrary code. (CVE-2022-0213)\n\nIt was discovered that Vim was incorrectly handling window\nexchanging operations when in Visual mode, which could result in an\nout-of-bounds read. An attacker could possibly use this issue to\nexpose sensitive information. (CVE-2022-0319)\n\nIt was discovered that Vim was incorrectly handling recursion when\nparsing conditional expressions. An attacker could possibly use this\nissue to cause a denial of service or execute arbitrary code.\n(CVE-2022-0351)\n\nIt was discovered that Vim was not properly handling memory\nallocation when processing data in Ex mode, which could result in a\nheap buffer overflow. An attacker could possibly use this issue to\ncause a denial of service or execute arbitrary code.\n(CVE-2022-0359)\n\nIt was discovered that Vim was not properly performing bounds checks\nwhen executing line operations in Visual mode, which could result in\na heap buffer overflow. An attacker could possibly use this issue to\ncause a denial of service or execute arbitrary code.\n(CVE-2022-0361, CVE-2022-0368)\n\nIt was discovered that Vim was not properly handling loop conditions\nwhen looking for spell suggestions, which could result in a stack\nbuffer overflow. An attacker could possibly use this issue to cause\na denial of service or execute arbitrary code. (CVE-2022-0408)\n\nIt was discovered that Vim was incorrectly handling memory access\nwhen executing buffer operations, which could result in the usage of\nfreed memory. An attacker could possibly use this issue to execute\narbitrary code. (CVE-2022-0443)\n","modified":"2026-02-10T04:42:38Z","published":"2022-06-02T12:21:05Z","related":["UBUNTU-CVE-2021-4193","UBUNTU-CVE-2022-0213","UBUNTU-CVE-2022-0319","UBUNTU-CVE-2022-0351","UBUNTU-CVE-2022-0359","UBUNTU-CVE-2022-0361","UBUNTU-CVE-2022-0368","UBUNTU-CVE-2022-0408","UBUNTU-CVE-2022-0443"],"upstream":["CVE-2021-4193","CVE-2022-0213","CVE-2022-0319","CVE-2022-0351","CVE-2022-0359","CVE-2022-0361","CVE-2022-0368","CVE-2022-0408","CVE-2022-0443","UBUNTU-CVE-2021-4193","UBUNTU-CVE-2022-0213","UBUNTU-CVE-2022-0319","UBUNTU-CVE-2022-0351","UBUNTU-CVE-2022-0359","UBUNTU-CVE-2022-0361","UBUNTU-CVE-2022-0368","UBUNTU-CVE-2022-0408","UBUNTU-CVE-2022-0443"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-5458-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-4193"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-0213"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-0319"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-0351"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-0359"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-0361"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-0368"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-0408"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-0443"}],"affected":[{"package":{"name":"vim","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/vim@2:7.4.1689-3ubuntu1.5+esm5?arch=source&distro=esm-infra/xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.1689-3ubuntu1.5+esm5"}]}],"versions":["2:7.4.712-2ubuntu4","2:7.4.826-1ubuntu1","2:7.4.826-1ubuntu2","2:7.4.826-1ubuntu3","2:7.4.963-1ubuntu1","2:7.4.963-1ubuntu4","2:7.4.963-1ubuntu5","2:7.4.1689-3ubuntu1","2:7.4.1689-3ubuntu1.1","2:7.4.1689-3ubuntu1.2","2:7.4.1689-3ubuntu1.3","2:7.4.1689-3ubuntu1.4","2:7.4.1689-3ubuntu1.5","2:7.4.1689-3ubuntu1.5+esm2","2:7.4.1689-3ubuntu1.5+esm3","2:7.4.1689-3ubuntu1.5+esm4"],"ecosystem_specific":{"binaries":[{"binary_version":"2:7.4.1689-3ubuntu1.5+esm5","binary_name":"vim"},{"binary_version":"2:7.4.1689-3ubuntu1.5+esm5","binary_name":"vim-athena"},{"binary_version":"2:7.4.1689-3ubuntu1.5+esm5","binary_name":"vim-athena-py2"},{"binary_version":"2:7.4.1689-3ubuntu1.5+esm5","binary_name":"vim-common"},{"binary_version":"2:7.4.1689-3ubuntu1.5+esm5","binary_name":"vim-gnome"},{"binary_version":"2:7.4.1689-3ubuntu1.5+esm5","binary_name":"vim-gnome-py2"},{"binary_version":"2:7.4.1689-3ubuntu1.5+esm5","binary_name":"vim-gtk"},{"binary_version":"2:7.4.1689-3ubuntu1.5+esm5","binary_name":"vim-gtk-py2"},{"binary_version":"2:7.4.1689-3ubuntu1.5+esm5","binary_name":"vim-gtk3"},{"binary_version":"2:7.4.1689-3ubuntu1.5+esm5","binary_name":"vim-gtk3-py2"},{"binary_version":"2:7.4.1689-3ubuntu1.5+esm5","binary_name":"vim-gui-common"},{"binary_version":"2:7.4.1689-3ubuntu1.5+esm5","binary_name":"vim-nox"},{"binary_version":"2:7.4.1689-3ubuntu1.5+esm5","binary_name":"vim-nox-py2"},{"binary_version":"2:7.4.1689-3ubuntu1.5+esm5","binary_name":"vim-runtime"},{"binary_version":"2:7.4.1689-3ubuntu1.5+esm5","binary_name":"vim-tiny"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-5458-1.json","cves_map":{"cves":[{"id":"CVE-2021-4193","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2022-0213","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2022-0319","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2022-0351","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2022-0359","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2022-0361","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2022-0368","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2022-0408","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2022-0443","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]}],"ecosystem":"Ubuntu:Pro:16.04:LTS"}}}],"schema_version":"1.7.3"}