Vulnerability · Published Feb 17, 2022 · Assigned by @huntrdev

CVE-2022-0629Stack-based Buffer Overflow in vim/vim

High 8.4

In plain English

A high-severity stack buffer overflow in vim/vim from vim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)8.4High

Exploit odds (30 days)1.9%top 20.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.20	vim	8.2.4542-r0	ALPINE-CVE-2022-0629
Alpine:v3.21	vim	8.2.4542-r0	ALPINE-CVE-2022-0629
Alpine:v3.22	vim	8.2.4542-r0	ALPINE-CVE-2022-0629
Alpine:v3.23	vim	8.2.4542-r0	ALPINE-CVE-2022-0629
Alpine:v3.24	vim	8.2.4542-r0	ALPINE-CVE-2022-0629
Debian:12	vim	2:8.2.4659-1	DEBIAN-CVE-2022-0629
Debian:13	vim	2:8.2.4659-1	DEBIAN-CVE-2022-0629
Debian:14	vim	2:8.2.4659-1	DEBIAN-CVE-2022-0629
Ubuntu:22.04:LTS	vim	2:8.2.3995-1ubuntu2.7	UBUNTU-CVE-2022-0629
Ubuntu:22.04:LTS	vim	2:8.2.3995-1ubuntu2.7	USN-6026-1

Affected products (as reported)

Vendor	Product	Versions
vim	vim/vim	unspecified – before 8.2

Weakness: CWE-121 · Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://huntr.dev/bounties/95e2b0da-e480-4ee8-9324-a93a2ab0a877
https://github.com/vim/vim/commit/34f8117dec685ace52cd9e578e2729db278163fc
FEDORA-2022-8622ebdebb vendor-advisory
FEDORA-2022-48bf3cb1c4 vendor-advisory
GLSA-202208-32 vendor-advisory
https://support.apple.com/kb/HT213488
20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13 mailing-list
20221030 APPLE-SA-2022-10-24-2 macOS Ventura 13 mailing-list
[debian-lts-announce] 20221124 [SECURITY] [DLA 3204-1] vim security update mailing-list