Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.

Bug 2057187 (CVE-2022-0714)

Summary:	CVE-2022-0714 vim: buffer overflow
Product:	[Other] Security Response	Reporter:	Anten Skrabec <askrabec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	fhrdina, gchamoul, karsten, michal.skrivanek, mperina, sbonazzo, zdohnal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	vim 8.2.4436	Doc Type:	If docs needed, set a value
Doc Text:	A heap-buffer-overflow flaw was found in vim's win_lbr_chartabsize() function of charset.c file. The issue occurs due to an incorrect 'vartabstop' value. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering a heap-overflow, and can cause an application to crash, eventually leading to a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-17 15:15:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2057704, 2057705, 2057781
Bug Blocks:

Description Anten Skrabec 2022-02-22 22:15:55 UTC

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

https://github.com/vim/vim/commit/4e889f98e95ac05d7c8bd3ee933ab4d47820fdfa
https://huntr.dev/bounties/db70e8db-f309-4f3c-986c-e69d2415c3b3

Comment 1 Anten Skrabec 2022-02-23 21:18:34 UTC

Created vim tracking bugs for this issue:

Affects: fedora-34 [bug 2057705]
Affects: fedora-35 [bug 2057704]

Comment 5 Product Security DevOps Team 2022-05-17 15:15:08 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-0714