Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 14 Jan 2022 19:22:11 -0800
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Re: 3 new CVE's in vim

On 10/4/21 08:48, Alan Coopersmith wrote:
> On 9/30/2021 7:39 PM, Alan Coopersmith wrote:
>> I haven't seen these make it to the list yet, but three CVE's were
>> recently assigned for bugs in vim.  [I personally don't see how
>> there's a security boundary crossed in normal vim usage here, but
>> could see issues if someone had configured vim to run with raised
>> privileges for editing system/application configuration files or
>> similar.]
> 
> I do note all three of these were submitted via huntr.dev, which offers
> bounties for both reporting & fixing security bugs.  As a maintainer of
> an upstream open source project which is struggling with finding people
> to fix reported security bugs [1], I do appreciate the additional
> incentive to provide fixes here.  But as a maintainer of a distro, I see
> a mismatch with the incentives here, as you get bounties for accepting
> everything as a security bug and not pushing back, and flooding the
> distros with CVE's - even if your distro policy isn't to handle every
> CVE that applies, security auditors will often make your users query
> about every CVE that they think applies, costing your time to respond.
> 
> [1] https://indico.freedesktop.org/event/1/contributions/28/
> https://www.youtube.com/watch?v=IU3NeVvDSp0

This has continued with many more CVE's issued for vim:

CVE-2022-0213 	vim is vulnerable to Heap-based Buffer Overflow
CVE-2022-0158 	vim is vulnerable to Heap-based Buffer Overflow
CVE-2022-0156 	vim is vulnerable to Use After Free
CVE-2022-0128 	vim is vulnerable to Out-of-bounds Read
CVE-2021-46059 	A Pointer Dereference vulnerability exists in Vim 8.2.3883 via 
the vim_regexec_multi function at regexp.c, which causes a denial of service.
CVE-2021-4193 	vim is vulnerable to Out-of-bounds Read
CVE-2021-4192 	vim is vulnerable to Use After Free
CVE-2021-4187 	vim is vulnerable to Use After Free
CVE-2021-4173 	vim is vulnerable to Use After Free
CVE-2021-4166 	vim is vulnerable to Out-of-bounds Read
CVE-2021-4136 	vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-4069 	vim is vulnerable to Use After Free
CVE-2021-4019 	vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3984 	vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3974 	vim is vulnerable to Use After Free
CVE-2021-3973 	vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3968 	vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3928 	vim is vulnerable to Use of Uninitialized Variable
CVE-2021-3927 	vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3903 	vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3875 	vim is vulnerable to Heap-based Buffer Overflow

-- 
         -Alan Coopersmith-                 alan.coopersmith@...cle.com
          Oracle Solaris Engineering - https://blogs.oracle.com/solaris

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.