7.8

CVE-2022-1616

Exploit

Use after free in append_command in vim/vim

Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Vim ≫ Vim Version < 8.2.4895
Fedoraproject ≫ Fedora Version34
Fedoraproject ≫ Fedora Version35
Fedoraproject ≫ Fedora Version36
Debian ≫ Debian Linux Version9.0
Debian ≫ Debian Linux Version10.0
Apple ≫ macOS Version < 13.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.65% 0.837
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
security@huntr.dev 7.3 1.8 5.5
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

http://seclists.org/fulldisclosure/2022/Oct/28
Third Party Advisory
Mailing List
http://seclists.org/fulldisclosure/2022/Oct/41
Third Party Advisory
Mailing List
Release Notes
https://support.apple.com/kb/HT213488
Third Party Advisory
Release Notes
https://security.gentoo.org/glsa/202208-32
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2022/05/msg00022.html
Third Party Advisory
Mailing List
https://security.gentoo.org/glsa/202305-16
https://github.com/vim/vim/commit/d88934406c5375d88f8f1b65331c9f0cab68cc6c
Patch
Third Party Advisory
https://huntr.dev/bounties/40f1d75f-fb2f-4281-b585-a41017f217e2
Patch
Third Party Advisory
Exploit
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A6BY5P7ERZS7KXSBCGFCOXLMLGWUUJIH/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIP7KG7TVS5YF3QREAY2GOGUT3YUBZAI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUN33257RUM4RS2I4GZETKFSAXPETATG/
https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html