{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "* SECURITY UPDATE: Reading past end of completion with a long line and\n 'infercase' set\n - debian/patches/CVE-2022-2343.patch: Allocate the string if needed\n - CVE-2022-2343\n * SECURITY UPDATE: Accessing uninitialized memory when completing long\n line\n - debian/patches/CVE-2022-2522.patch: Terminate string with NUL.\n - CVE-2022-2522", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/debian10els/advisories/2025/clsa-2025_1762180717.json" }, { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2025:1762180717", "url": "https://cve.tuxcare.com/els/releases/CLSA-2025:1762180717" } ], "tracking": { "current_release_date": "2025-11-03T14:41:33Z", "generator": { "date": "2025-11-03T14:41:33Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2025:1762180717", "initial_release_date": "2025-11-03T14:41:33Z", "revision_history": [ { "date": "2025-11-03T14:41:33Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "Fix CVE(s): CVE-2022-2343, CVE-2022-2522" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian None", "product": { "name": "Debian None", "product_id": "Debian-10", "product_identification_helper": { "cpe": "cpe:2.3:o:debian:debian_linux:10:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Debian" } ], "category": "vendor", "name": "Software in the Public Interest, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "product": { "name": "vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "product_id": "vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/vim-gui-common@8.1.0875-5%2Bdeb10u6%2Btuxcare.els9?arch=all" } } }, { "category": "product_version", "name": "vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "product": { "name": "vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "product_id": "vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/vim-common@8.1.0875-5%2Bdeb10u6%2Btuxcare.els9?arch=all" } } }, { "category": "product_version", "name": "vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "product": { "name": "vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "product_id": "vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/vim-runtime@8.1.0875-5%2Bdeb10u6%2Btuxcare.els9?arch=all" } } }, { "category": "product_version", "name": "vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "product": { "name": "vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "product_id": "vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "product_identification_helper": { "purl": "pkg:deb/tuxcare/vim-doc@8.1.0875-5%2Bdeb10u6%2Btuxcare.els9?arch=all" } } } ], "category": "architecture", "name": "all" }, { "branches": [ { "category": "product_version", "name": "vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product": { "name": "vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product_id": "vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/vim-tiny@8.1.0875-5%2Bdeb10u6%2Btuxcare.els9?arch=amd64" } } }, { "category": "product_version", "name": "vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product": { "name": "vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product_id": "vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/vim-athena@8.1.0875-5%2Bdeb10u6%2Btuxcare.els9?arch=amd64" } } }, { "category": "product_version", "name": "xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product": { "name": "xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product_id": "xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/xxd@8.1.0875-5%2Bdeb10u6%2Btuxcare.els9?arch=amd64" } } }, { "category": "product_version", "name": "vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product": { "name": "vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product_id": "vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/vim-gtk3@8.1.0875-5%2Bdeb10u6%2Btuxcare.els9?arch=amd64" } } }, { "category": "product_version", "name": "vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product": { "name": "vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product_id": "vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/vim-gtk@8.1.0875-5%2Bdeb10u6%2Btuxcare.els9?arch=amd64" } } }, { "category": "product_version", "name": "vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product": { "name": "vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product_id": "vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/vim-nox@8.1.0875-5%2Bdeb10u6%2Btuxcare.els9?arch=amd64" } } }, { "category": "product_version", "name": "vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product": { "name": "vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product_id": "vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/vim@8.1.0875-5%2Bdeb10u6%2Btuxcare.els9?arch=amd64" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all as a component of Debian None", "product_id": "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all" }, "product_reference": "vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64 as a component of Debian None", "product_id": "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" }, "product_reference": "vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64 as a component of Debian None", "product_id": "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" }, "product_reference": "vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64 as a component of Debian None", "product_id": "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" }, "product_reference": "xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all as a component of Debian None", "product_id": "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all" }, "product_reference": "vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all as a component of Debian None", "product_id": "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all" }, "product_reference": "vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64 as a component of Debian None", "product_id": "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" }, "product_reference": "vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64 as a component of Debian None", "product_id": "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" }, "product_reference": "vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64 as a component of Debian None", "product_id": "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" }, "product_reference": "vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64 as a component of Debian None", "product_id": "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" }, "product_reference": "vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "relates_to_product_reference": "Debian-10" }, { "category": "default_component_of", "full_product_name": { "name": "vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all as a component of Debian None", "product_id": "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all" }, "product_reference": "vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "relates_to_product_reference": "Debian-10" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-2125", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-2125" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Oct/28", "url": "http://seclists.org/fulldisclosure/2022/Oct/28" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Oct/41", "url": "http://seclists.org/fulldisclosure/2022/Oct/41" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Oct/43", "url": "http://seclists.org/fulldisclosure/2022/Oct/43" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Oct/45", "url": "http://seclists.org/fulldisclosure/2022/Oct/45" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/0e8e938d497260dd57be67b4966cb27a5f72376f", "url": "https://github.com/vim/vim/commit/0e8e938d497260dd57be67b4966cb27a5f72376f" }, { "category": "external", "summary": "https://huntr.dev/bounties/17dab24d-beec-464d-9a72-5b6b11283705", "url": "https://huntr.dev/bounties/17dab24d-beec-464d-9a72-5b6b11283705" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202208-32", "url": "https://security.gentoo.org/glsa/202208-32" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213443", "url": "https://support.apple.com/kb/HT213443" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213444", "url": "https://support.apple.com/kb/HT213444" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213488", "url": "https://support.apple.com/kb/HT213488" } ], "release_date": "2022-06-19T12:15:00Z", "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-0049", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-0049" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2023/Mar/17", "url": "http://seclists.org/fulldisclosure/2023/Mar/17" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/7b17eb4b063a234376c1ec909ee293e42cff290c", "url": "https://github.com/vim/vim/commit/7b17eb4b063a234376c1ec909ee293e42cff290c" }, { "category": "external", "summary": "https://huntr.dev/bounties/5e6f325c-ba54-4bf0-b050-dca048fd3fd9", "url": "https://huntr.dev/bounties/5e6f325c-ba54-4bf0-b050-dca048fd3fd9" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3Y752EAVACVC5XY2TMGGOAIU25VQRPDW/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3Y752EAVACVC5XY2TMGGOAIU25VQRPDW/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T33LLWHLH63XDCO5OME7NWN63RA4U5HF/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T33LLWHLH63XDCO5OME7NWN63RA4U5HF/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213670", "url": "https://support.apple.com/kb/HT213670" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20250117-0005/", "url": "https://security.netapp.com/advisory/ntap-20250117-0005/" } ], "release_date": "2023-01-04T16:15:00Z", "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-4292", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "Use After Free in GitHub repository vim/vim prior to 9.0.0882.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-4292" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/c3d27ada14acd02db357f2d16347acc22cb17e93", "url": "https://github.com/vim/vim/commit/c3d27ada14acd02db357f2d16347acc22cb17e93" }, { "category": "external", "summary": "https://huntr.dev/bounties/da3d4c47-e57a-451e-993d-9df0ed31f57b", "url": "https://huntr.dev/bounties/da3d4c47-e57a-451e-993d-9df0ed31f57b" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYC22GGZ6QA66HLNLHCTAJU265TT3O33/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYC22GGZ6QA66HLNLHCTAJU265TT3O33/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20230113-0005/", "url": "https://security.netapp.com/advisory/ntap-20230113-0005/" } ], "release_date": "2022-12-05T19:15:00Z", "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-3591", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "Use After Free in GitHub repository vim/vim prior to 9.0.0789.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-3591" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/8f3c3c6cd044e3b5bf08dbfa3b3f04bb3f711bad", "url": "https://github.com/vim/vim/commit/8f3c3c6cd044e3b5bf08dbfa3b3f04bb3f711bad" }, { "category": "external", "summary": "https://huntr.dev/bounties/a5a998c2-4b07-47a7-91be-dbc1886b3921", "url": "https://huntr.dev/bounties/a5a998c2-4b07-47a7-91be-dbc1886b3921" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" } ], "release_date": "2022-12-02T17:15:00Z", "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-2264", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-2264" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/d25f003342aca9889067f2e839963dfeccf1fe05", "url": "https://github.com/vim/vim/commit/d25f003342aca9889067f2e839963dfeccf1fe05" }, { "category": "external", "summary": "https://huntr.dev/bounties/2241c773-02c9-4708-b63e-54aef99afa6c", "url": "https://huntr.dev/bounties/2241c773-02c9-4708-b63e-54aef99afa6c" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202208-32", "url": "https://security.gentoo.org/glsa/202208-32" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" } ], "release_date": "2022-07-01T11:15:00Z", "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-2845", "cwe": { "id": "CWE-1284", "name": "Improper Validation of Specified Quantity in Input" }, "notes": [ { "category": "description", "text": "Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218.\n\n", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-2845" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/e98c88c44c308edaea5994b8ad4363e65030968c", "url": "https://github.com/vim/vim/commit/e98c88c44c308edaea5994b8ad4363e65030968c" }, { "category": "external", "summary": "https://huntr.dev/bounties/3e1d31ac-1cfd-4a9f-bc5c-213376b69445", "url": "https://huntr.dev/bounties/3e1d31ac-1cfd-4a9f-bc5c-213376b69445" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C72HDIMR3KTTAO7QGTXWUMPBNFUFIBRD/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C72HDIMR3KTTAO7QGTXWUMPBNFUFIBRD/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" } ], "release_date": "2022-08-17T15:15:00Z", "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-2344", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-2344" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/baefde14550231f6468ac2ed2ed495bc381c0c92", "url": "https://github.com/vim/vim/commit/baefde14550231f6468ac2ed2ed495bc381c0c92" }, { "category": "external", "summary": "https://huntr.dev/bounties/4a095ed9-3125-464a-b656-c31b437e1996", "url": "https://huntr.dev/bounties/4a095ed9-3125-464a-b656-c31b437e1996" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202208-32", "url": "https://security.gentoo.org/glsa/202208-32" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" } ], "release_date": "2022-07-08T19:15:00Z", "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-2206", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-2206" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/e178af5a586ea023622d460779fdcabbbfac0908", "url": "https://github.com/vim/vim/commit/e178af5a586ea023622d460779fdcabbbfac0908" }, { "category": "external", "summary": "https://huntr.dev/bounties/01d01e74-55d0-4d9e-878e-79ba599be668", "url": "https://huntr.dev/bounties/01d01e74-55d0-4d9e-878e-79ba599be668" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202208-32", "url": "https://security.gentoo.org/glsa/202208-32" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" } ], "release_date": "2022-06-26T19:15:00Z", "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-2257", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-2257" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/083692d598139228e101b8c521aaef7bcf256e9a", "url": "https://github.com/vim/vim/commit/083692d598139228e101b8c521aaef7bcf256e9a" }, { "category": "external", "summary": "https://huntr.dev/bounties/ca581f80-03ba-472a-b820-78f7fd05fe89", "url": "https://huntr.dev/bounties/ca581f80-03ba-472a-b820-78f7fd05fe89" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202208-32", "url": "https://security.gentoo.org/glsa/202208-32" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" } ], "release_date": "2022-06-30T21:15:00Z", "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-2210", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-2210" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/c101abff4c6756db4f5e740fde289decb9452efa", "url": "https://github.com/vim/vim/commit/c101abff4c6756db4f5e740fde289decb9452efa" }, { "category": "external", "summary": "https://huntr.dev/bounties/020845f8-f047-4072-af0f-3726fe1aea25", "url": "https://huntr.dev/bounties/020845f8-f047-4072-af0f-3726fe1aea25" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202208-32", "url": "https://security.gentoo.org/glsa/202208-32" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" } ], "release_date": "2022-06-27T16:15:00Z", "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-2182", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-2182" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/f7c7c3fad6d2135d558f3b36d0d1a943118aeb5e", "url": "https://github.com/vim/vim/commit/f7c7c3fad6d2135d558f3b36d0d1a943118aeb5e" }, { "category": "external", "summary": "https://huntr.dev/bounties/238d8650-3beb-4831-a8f7-6f0b597a6fb8", "url": "https://huntr.dev/bounties/238d8650-3beb-4831-a8f7-6f0b597a6fb8" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202208-32", "url": "https://security.gentoo.org/glsa/202208-32" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" } ], "release_date": "2022-06-23T18:15:00Z", "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-2522", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-2522" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/5fa9f23a63651a8abdb074b4fc2ec9b1adc6b089", "url": "https://github.com/vim/vim/commit/5fa9f23a63651a8abdb074b4fc2ec9b1adc6b089" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/b9e717367c395490149495cf375911b5d9de889e", "url": "https://github.com/vim/vim/commit/b9e717367c395490149495cf375911b5d9de889e" }, { "category": "external", "summary": "https://huntr.dev/bounties/3a2d83af-9542-4d93-8784-98b115135a22", "url": "https://huntr.dev/bounties/3a2d83af-9542-4d93-8784-98b115135a22" }, { "category": "external", "summary": "https://huntr.dev/bounties/3a2d83af-9542-4d93-8784-98b115135a22/", "url": "https://huntr.dev/bounties/3a2d83af-9542-4d93-8784-98b115135a22/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" } ], "release_date": "2022-07-25T14:15:00Z", "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-2207", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-2207" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/0971c7a4e537ea120a6bb2195960be8d0815e97b", "url": "https://github.com/vim/vim/commit/0971c7a4e537ea120a6bb2195960be8d0815e97b" }, { "category": "external", "summary": "https://huntr.dev/bounties/05bc6051-4dc3-483b-ae56-cf23346b97b9", "url": "https://huntr.dev/bounties/05bc6051-4dc3-483b-ae56-cf23346b97b9" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202208-32", "url": "https://security.gentoo.org/glsa/202208-32" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" } ], "release_date": "2022-06-27T12:15:00Z", "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-2175", "cwe": { "id": "CWE-126", "name": "Buffer Over-read" }, "notes": [ { "category": "description", "text": "Buffer Over-read in GitHub repository vim/vim prior to 8.2.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-2175" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/6046aded8da002b08d380db29de2ba0268b6616e", "url": "https://github.com/vim/vim/commit/6046aded8da002b08d380db29de2ba0268b6616e" }, { "category": "external", "summary": "https://huntr.dev/bounties/7f0481c2-8b57-4324-b47c-795d1ea67e55", "url": "https://huntr.dev/bounties/7f0481c2-8b57-4324-b47c-795d1ea67e55" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202208-32", "url": "https://security.gentoo.org/glsa/202208-32" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" } ], "release_date": "2022-06-23T13:15:00Z", "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-2183", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-2183" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/8eba2bd291b347e3008aa9e565652d51ad638cfa", "url": "https://github.com/vim/vim/commit/8eba2bd291b347e3008aa9e565652d51ad638cfa" }, { "category": "external", "summary": "https://huntr.dev/bounties/d74ca3f9-380d-4c0a-b61c-11113cc98975", "url": "https://huntr.dev/bounties/d74ca3f9-380d-4c0a-b61c-11113cc98975" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202208-32", "url": "https://security.gentoo.org/glsa/202208-32" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" } ], "release_date": "2022-06-23T19:15:00Z", "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-2343", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-2343" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/caea66442d86e7bbba3bf3dc202c3c0d549b9853", "url": "https://github.com/vim/vim/commit/caea66442d86e7bbba3bf3dc202c3c0d549b9853" }, { "category": "external", "summary": "https://huntr.dev/bounties/2ecb4345-2fc7-4e7f-adb0-83a20bb458f5", "url": "https://huntr.dev/bounties/2ecb4345-2fc7-4e7f-adb0-83a20bb458f5" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202208-32", "url": "https://security.gentoo.org/glsa/202208-32" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" } ], "release_date": "2022-07-08T18:15:00Z", "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-2345", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "Use After Free in GitHub repository vim/vim prior to 9.0.0046.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-2345" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/32acf1f1a72ebb9d8942b9c9d80023bf1bb668ea", "url": "https://github.com/vim/vim/commit/32acf1f1a72ebb9d8942b9c9d80023bf1bb668ea" }, { "category": "external", "summary": "https://huntr.dev/bounties/1eed7009-db6d-487b-bc41-8f2fd260483f", "url": "https://huntr.dev/bounties/1eed7009-db6d-487b-bc41-8f2fd260483f" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202208-32", "url": "https://security.gentoo.org/glsa/202208-32" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" } ], "release_date": "2022-07-08T22:15:00Z", "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-2289", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "Use After Free in GitHub repository vim/vim prior to 9.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-2289" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/c5274dd12224421f2430b30c53b881b9403d649e", "url": "https://github.com/vim/vim/commit/c5274dd12224421f2430b30c53b881b9403d649e" }, { "category": "external", "summary": "https://huntr.dev/bounties/7447d2ea-db5b-4883-adf4-1eaf7deace64", "url": "https://huntr.dev/bounties/7447d2ea-db5b-4883-adf4-1eaf7deace64" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202208-32", "url": "https://security.gentoo.org/glsa/202208-32" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" } ], "release_date": "2022-07-03T15:15:00Z", "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-2126", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-2126" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Oct/28", "url": "http://seclists.org/fulldisclosure/2022/Oct/28" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Oct/41", "url": "http://seclists.org/fulldisclosure/2022/Oct/41" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Oct/43", "url": "http://seclists.org/fulldisclosure/2022/Oct/43" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Oct/45", "url": "http://seclists.org/fulldisclosure/2022/Oct/45" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/156d3911952d73b03d7420dc3540215247db0fe8", "url": "https://github.com/vim/vim/commit/156d3911952d73b03d7420dc3540215247db0fe8" }, { "category": "external", "summary": "https://huntr.dev/bounties/8d196d9b-3d10-41d2-9f70-8ef0d08c946e", "url": "https://huntr.dev/bounties/8d196d9b-3d10-41d2-9f70-8ef0d08c946e" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2022/06/msg00014.html", "url": "https://lists.debian.org/debian-lts-announce/2022/06/msg00014.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202208-32", "url": "https://security.gentoo.org/glsa/202208-32" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213443", "url": "https://support.apple.com/kb/HT213443" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213444", "url": "https://support.apple.com/kb/HT213444" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213488", "url": "https://support.apple.com/kb/HT213488" } ], "release_date": "2022-06-19T13:15:00Z", "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-2124", "cwe": { "id": "CWE-126", "name": "Buffer Over-read" }, "notes": [ { "category": "description", "text": "Buffer Over-read in GitHub repository vim/vim prior to 8.2.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-2124" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Oct/28", "url": "http://seclists.org/fulldisclosure/2022/Oct/28" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Oct/41", "url": "http://seclists.org/fulldisclosure/2022/Oct/41" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Oct/43", "url": "http://seclists.org/fulldisclosure/2022/Oct/43" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2022/Oct/45", "url": "http://seclists.org/fulldisclosure/2022/Oct/45" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/2f074f4685897ab7212e25931eeeb0212292829f", "url": "https://github.com/vim/vim/commit/2f074f4685897ab7212e25931eeeb0212292829f" }, { "category": "external", "summary": "https://huntr.dev/bounties/8e9e056d-f733-4540-98b6-414bf36e0b42", "url": "https://huntr.dev/bounties/8e9e056d-f733-4540-98b6-414bf36e0b42" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2022/06/msg00014.html", "url": "https://lists.debian.org/debian-lts-announce/2022/06/msg00014.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202208-32", "url": "https://security.gentoo.org/glsa/202208-32" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213443", "url": "https://support.apple.com/kb/HT213443" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213444", "url": "https://support.apple.com/kb/HT213444" }, { "category": "external", "summary": "https://support.apple.com/kb/HT213488", "url": "https://support.apple.com/kb/HT213488" } ], "release_date": "2022-06-19T10:15:00Z", "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-2287", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-2287" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/5e59ea54c0c37c2f84770f068d95280069828774", "url": "https://github.com/vim/vim/commit/5e59ea54c0c37c2f84770f068d95280069828774" }, { "category": "external", "summary": "https://huntr.dev/bounties/654aa069-3a9d-45d3-9a52-c1cf3490c284", "url": "https://huntr.dev/bounties/654aa069-3a9d-45d3-9a52-c1cf3490c284" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202208-32", "url": "https://security.gentoo.org/glsa/202208-32" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" } ], "release_date": "2022-07-02T22:15:00Z", "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-2286", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-2286" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/f12129f1714f7d2301935bb21d896609bdac221c", "url": "https://github.com/vim/vim/commit/f12129f1714f7d2301935bb21d896609bdac221c" }, { "category": "external", "summary": "https://huntr.dev/bounties/fe7681fb-2318-436b-8e65-daf66cd597d8", "url": "https://huntr.dev/bounties/fe7681fb-2318-436b-8e65-daf66cd597d8" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202208-32", "url": "https://security.gentoo.org/glsa/202208-32" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" } ], "release_date": "2022-07-02T19:15:00Z", "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-2284", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-2284" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/3d51ce18ab1be4f9f6061568a4e7fabf00b21794", "url": "https://github.com/vim/vim/commit/3d51ce18ab1be4f9f6061568a4e7fabf00b21794" }, { "category": "external", "summary": "https://huntr.dev/bounties/571d25ce-8d53-4fa0-b620-27f2a8a14874", "url": "https://huntr.dev/bounties/571d25ce-8d53-4fa0-b620-27f2a8a14874" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202208-32", "url": "https://security.gentoo.org/glsa/202208-32" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202305-16", "url": "https://security.gentoo.org/glsa/202305-16" } ], "release_date": "2022-07-02T15:15:00Z", "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-10:vim-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-athena-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-doc-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-gtk-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gtk3-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-gui-common-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-nox-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:vim-runtime-2:8.1.0875-5+deb10u6+tuxcare.els9.all", "Debian-10:vim-tiny-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64", "Debian-10:xxd-2:8.1.0875-5+deb10u6+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }