USN-5247-1: Vim vulnerabilities
27 January 2022
Several security issues were fixed in Vim.
Releases
Packages
- vim - Vi IMproved - enhanced vi editor
Details
It was discovered that vim incorrectly handled parsing of filenames in its
search functionality. If a user was tricked into opening a specially crafted
file, an attacker could crash the application, leading to a denial of
service. This issue only affected Ubuntu 21.10. (CVE-2021-3973)
It was discovered that vim incorrectly handled memory when opening and
searching the contents of certain files. If a user was tricked into opening
a specially crafted file, an attacker could crash the application, leading to
a denial of service, or possibly achieve code execution with user privileges.
This issue only affected Ubuntu 20.04 LTS and Ubuntu 21.10. (CVE-2021-3974)
It was discovered that vim incorrectly handled memory when opening and editing
certain files. If a user was tricked into opening a specially crafted file, an
attacker could crash the application, leading to a denial of service, or
possibly achieve code execution with user privileges. (CVE-2021-3984)
It was discovered that vim incorrectly handled memory when opening and editing
certain files. If a user was tricked into opening a specially crafted file, an
attacker could crash the application, leading to a denial of service, or
possibly achieve code execution with user privileges. (CVE-2021-4019)
It was discovered that vim incorrectly handled memory when opening and editing
certain files. If a user was tricked into opening a specially crafted file, an
attacker could crash the application, leading to a denial of service, or
possibly achieve code execution with user privileges.(CVE-2021-4069)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 21.10
Ubuntu 20.04
Ubuntu 18.04
In general, a standard system update will make all the necessary changes.