vim-9.1.???? (Update before release)

[Bruce Dubbs]

Update vim to latest patch version before release.

[Bruce Dubbs]

Updated to vim-8.1.1846 at revision 11656.

Leaving ticket open.

[Bruce Dubbs]

vim-8.2.0000 is available.

Promoting to milestone 9.1 so we put it in now, but should probably move the ticket back to future after that update.

[Bruce Dubbs]

Release notes for 8.2 are at

​https://www.vim.org/vim-8.2-released.php

[Pierre Labastie]

Updated to 8.2.0024 at r11711

[Bruce Dubbs]

Updated to version 8.2.0129 at revision 11731.

[Bruce Dubbs]

Updated to version 8.2.0190 at revision 11738.

[Douglas R. Reno]

Updating vim again at the next LFS update would be a good idea.

On 10/4/21 08:48, Alan Coopersmith wrote:
> On 9/30/2021 7:39 PM, Alan Coopersmith wrote:
>> I haven't seen these make it to the list yet, but three CVE's were
>> recently assigned for bugs in vim.  [I personally don't see how
>> there's a security boundary crossed in normal vim usage here, but
>> could see issues if someone had configured vim to run with raised
>> privileges for editing system/application configuration files or
>> similar.]
>
> I do note all three of these were submitted via huntr.dev, which offers
> bounties for both reporting & fixing security bugs.  As a maintainer of
> an upstream open source project which is struggling with finding people
> to fix reported security bugs [1], I do appreciate the additional
> incentive to provide fixes here.  But as a maintainer of a distro, I see
> a mismatch with the incentives here, as you get bounties for accepting
> everything as a security bug and not pushing back, and flooding the
> distros with CVE's - even if your distro policy isn't to handle every
> CVE that applies, security auditors will often make your users query
> about every CVE that they think applies, costing your time to respond.
>
> [1] https://indico.freedesktop.org/event/1/contributions/28/
> https://www.youtube.com/watch?v=IU3NeVvDSp0

This has continued with many more CVE's issued for vim:

CVE-2022-0213     vim is vulnerable to Heap-based Buffer Overflow
CVE-2022-0158     vim is vulnerable to Heap-based Buffer Overflow
CVE-2022-0156     vim is vulnerable to Use After Free
CVE-2022-0128     vim is vulnerable to Out-of-bounds Read
CVE-2021-46059     A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service.
CVE-2021-4193     vim is vulnerable to Out-of-bounds Read
CVE-2021-4192     vim is vulnerable to Use After Free
CVE-2021-4187     vim is vulnerable to Use After Free
CVE-2021-4173     vim is vulnerable to Use After Free
CVE-2021-4166     vim is vulnerable to Out-of-bounds Read
CVE-2021-4136     vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-4069     vim is vulnerable to Use After Free
CVE-2021-4019     vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3984     vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3974     vim is vulnerable to Use After Free
CVE-2021-3973     vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3968     vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3928     vim is vulnerable to Use of Uninitialized Variable
CVE-2021-3927     vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3903     vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3875     vim is vulnerable to Heap-based Buffer Overflow 

[ken@…]

Replying to Douglas R. Reno:

Updating vim again at the next LFS update would be a good idea.

On 10/4/21 08:48, Alan Coopersmith wrote:
> On 9/30/2021 7:39 PM, Alan Coopersmith wrote:

[snip]

CVE-2021-46059 A Pointer Dereference vulnerability exists in Vim 8.2.3883 via the vim_regexec_multi function at regexp.c, which causes a denial of service.

CVE-2021-46059 has been rejected.

[ken@…]

It turns out that 8.2.4383 also contained a security update (applied in 8.2.4359) for a crash when repeatedly using :retab. ​https://github.com/vim/vim/commit/6e28703a8e41f775f64e442c5d11ce1ff599aa3f Not yet analyzed at NVD.

[Xi Ruoyao]

I'll update to 8.2.4489 for 4 CVEs (2022-0685,0714,0696,0729). Not sure how severe they are: their CVSS score are high but the upstream claims the worst thing could happen is a crash.

[ken@…]

Replying to Xi Ruoyao:

I'll update to 8.2.4489 for 4 CVEs (2022-0685,0714,0696,0729). Not sure how severe they are: their CVSS score are high but the upstream claims the worst thing could happen is a crash.

We've labelled application crashes, as well as lack of information on the consequences or severity, as High.

[Xi Ruoyao]

Replying to ken@…:

Replying to Xi Ruoyao:

I'll update to 8.2.4489 for 4 CVEs (2022-0685,0714,0696,0729). Not sure how severe they are: their CVSS score are high but the upstream claims the worst thing could happen is a crash.

We've labelled application crashes, as well as lack of information on the consequences or severity, as High.

SA 11.1-001 published with severity High.

[Xi Ruoyao]

CVE-2022-0943 is published with 8.4 HIGH.

[Xi Ruoyao]

CVE-2022-0943 fixed at f7ac150c8. Leave this assigned for SA.

[Xi Ruoyao]

SA 11.1-010 issued.

[Xi Ruoyao]

• CVE-2022-1154: Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646. (CVSS2 7.5 HIGH)
• CVE-2022-1160: heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647. (CVSS2 6.8 MEDIUM)

[Bruce Dubbs]

I'll update vim next week at my bi-monthly update.

[Xi Ruoyao]

• CVE-2022-1381: global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. (CVSS2 6.8 MEDIUM)

[Bruce Dubbs]

I have vim-8.2.4814 ready for inclusion in the next update. I plan on a full update of current tickets on April 30.

[Xi Ruoyao]

SA 11.1-037 issued.

[Xi Ruoyao]

• CVE-2022-1616: Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution (6.8 MEDIUM)
• CVE-2022-1620: NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash) via a crafted input. (5.0 MEDIUM)
• CVE-2022-1621: Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution (6.8 MEDIUM)
• CVE-2022-1629: Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software, Modify Memory, and possible remote execution (6.8 MEDIUM)
• CVE-2022-1674: NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 allows attackers to cause a denial of service (application crash) via a crafted input. (4.3 MEDIUM)

I'm going to build LFS for my old system (for testing latest Mesa with crocus, mainly) so I can update vim BTW.

[Xi Ruoyao]

• CVE-2022-1733: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4968. (4.6 MEDIUM)
• CVE-2022-1735: Classic Buffer Overflow in GitHub repository vim/vim prior to 8.2.4969. (6.8 MEDIUM)
• CVE-2022-1769: Buffer Over-read in GitHub repository vim/vim prior to 8.2.4974. (4.6 MEDIUM)
• CVE-2022-1771: Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975. (4.3 MEDIUM)
• CVE-2022-1785: Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.4977. (4.6 MEDIUM)
• CVE-2022-1796: Use After Free in GitHub repository vim/vim prior to 8.2.4979. (6.8 MEDIUM)

[Xi Ruoyao]

Fixed at r11.1-129-ge6e8f0047. Vim left assigned for SA.

[Xi Ruoyao]

SA 11.1-053 done.

[Xi Ruoyao]

Now 9.0.0001.

[Bruce Dubbs]

Replying to Xi Ruoyao:

Now 9.0.0001.

It's up to 9.0.0006 already. Seems to be some changes in scripting.

​https://github.com/brammool/vim9/blob/master/README.md

The date of this file is about 2 months ago.

[Xi Ruoyao]

Now 9.1.

[Douglas R. Reno]

heap-buffer-overflow with visual mode in Vim < 9.1.1003
=======================================================
Date: 11.01.2025
Severity: Medium
CVE: CVE-2025-22134
CWE: Heap-based Buffer Overflow (CWE-122)

When switching to other buffers using the :all command and visual mode
still being active, this may cause a heap-buffer overflow, because Vim
does not properly end visual mode and therefore may try to access
beyond the end of a line in a buffer.

In Patch 9.1.1003 Vim will correctly reset the visual mode before
opening other windows and buffers and therefore fix this bug.  In
addition it does verify that it won't try to access a position if the
position is greater than the corresponding buffer line.

Impact is medium since the user must have switched on visual mode when
executing the :all ex command.

The issue has been fixed as of Vim patch v9.1.1003

The Vim project would like to thank github user gandalf4a for reporting
this issue.

References:
https://github.com/vim/vim/commit/c9a1e257f1630a0866447e53a564f7ff96a80ead
https://github.com/vim/vim/security/advisories/GHSA-5rgf-26wj-48v8