CVE-2022-0696
Published: 21 February 2022
NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4428.
Notes
| Author | Note |
|---|---|
| ccdm94 | the line presented as the one containing the instruction that triggers the error in the bug report stack trace was introduced by commit a1198124370a (>= 8.2.3629). Eventhough the code for focal and impish is very similar to the vulnerable one, the reproducer does not work for impish and earlier, further indicating that the previously mentioned commit might have been the one to introduce the issue. |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
vim Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code not present)
|
| focal |
Not vulnerable
(code not present)
|
|
| impish |
Ignored
(end of life)
|
|
| jammy |
Released
(2:8.2.3995-1ubuntu2.9)
|
|
| kinetic |
Not vulnerable
(2:9.0.0242-1ubuntu1.4)
|
|
| lunar |
Not vulnerable
(2:9.0.0242-1ubuntu1)
|
|
| trusty |
Not vulnerable
(code not present)
|
|
| upstream |
Released
(8.2.4428)
|
|
| xenial |
Not vulnerable
(code not present)
|
|
|
Patches: upstream: https://github.com/vim/vim/commit/0f6e28f686dbb59ab3b562408ab9b2234797b9b1 |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 5.5 |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
References
- https://huntr.dev/bounties/7416c2cb-1809-4834-8989-e84ff033f15f/
- https://github.com/vim/vim/commit/0f6e28f686dbb59ab3b562408ab9b2234797b9b1 (v8.2.4428)
- https://github.com/vim/vim/commit/0f6e28f686dbb59ab3b562408ab9b2234797b9b1
- https://huntr.dev/bounties/7416c2cb-1809-4834-8989-e84ff033f15f
- https://ubuntu.com/security/notices/USN-6195-1
- https://www.cve.org/CVERecord?id=CVE-2022-0696
- NVD
- Launchpad
- Debian