Vulnerability · Published Sep 6, 2021 · Assigned by @huntrdev
CVE-2021-3770Heap-based Buffer Overflow in vim/vim
High 8.6
In plain English
A high-severity heap buffer overflow in vim/vim from vim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.0)8.6High
Exploit odds (30 days)0.7%top 45.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
vim is vulnerable to Heap-based Buffer Overflow
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | vim | 8.2.3437-r0 | ALPINE-CVE-2021-3770 |
| Alpine:v3.21 | vim | 8.2.3437-r0 | ALPINE-CVE-2021-3770 |
| Alpine:v3.22 | vim | 8.2.3437-r0 | ALPINE-CVE-2021-3770 |
| Alpine:v3.23 | vim | 8.2.3437-r0 | ALPINE-CVE-2021-3770 |
| Alpine:v3.24 | vim | 8.2.3437-r0 | ALPINE-CVE-2021-3770 |
| Debian:12 | vim | 2:8.2.3455-1 | DEBIAN-CVE-2021-3770 |
| Debian:13 | vim | 2:8.2.3455-1 | DEBIAN-CVE-2021-3770 |
| Debian:14 | vim | 2:8.2.3455-1 | DEBIAN-CVE-2021-3770 |
Affected products (as reported)
Weakness: CWE-122 · Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://huntr.dev/bounties/016ad2f2-07c1-4d14-a8ce-6eed10729365
- https://github.com/vim/vim/commit/b7081e135a16091c93f6f5f7525a5c58fb7ca9f9
- FEDORA-2021-5fa81a2b04 vendor-advisory
- FEDORA-2021-4a43cbe0b4 vendor-advisory
- FEDORA-2021-e982f972f2 vendor-advisory
- [oss-security] 20210930 3 new CVE's in vim mailing-list
- GLSA-202208-32 vendor-advisory
- https://security.netapp.com/advisory/ntap-20221124-0003/