CVE-2022-0351
Published on: 01/25/2022 12:00:00 AM UTC
Last Modified on: 11/09/2022 07:20:00 PM UTC
CVE-2022-0351 - advisory for 8b36db58-b65c-4298-be7f-40b9e37fd161
Source: Mitre Source: NIST CVE.ORG Print: PDF
Certain versions of Macos from Apple contain the following vulnerability:
Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.
- CVE-2022-0351 has been assigned by
[email protected] to track the vulnerability - currently rated as HIGH severity. - Affected Vendor/Software: vim - vim/vim version < 8.2
CVSS3 Score: 7.8 - HIGH
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| LOCAL | LOW | LOW | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | HIGH | HIGH | HIGH |
CVSS2 Score: 4.6 - MEDIUM
| Access Vector ⓘ |
Access Complexity |
Authentication |
|---|---|---|
| LOCAL | LOW | NONE |
| Confidentiality Impact |
Integrity Impact |
Availability Impact |
| PARTIAL | PARTIAL | PARTIAL |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| [SECURITY] [DLA 3011-1] vim security update | lists.debian.org text/html |
MLIST [debian-lts-announce] 20220516 [SECURITY] [DLA 3011-1] vim security update |
| About the security content of macOS Monterey 12.6 - Apple Support | support.apple.com text/html |
CONFIRM support.apple.com/kb/HT213444 |
| Full Disclosure: APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13 | seclists.org text/html |
FULLDISC 20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13 |
| [SECURITY] [DLA 3182-1] vim security update | lists.debian.org text/html |
MLIST [debian-lts-announce] 20221108 [SECURITY] [DLA 3182-1] vim security update |
| Vim, gVim: Multiple Vulnerabilities (GLSA 202208-32) — Gentoo security | security.gentoo.org text/html |
GENTOO GLSA-202208-32 |
| About the security content of macOS Ventura 13 - Apple Support | support.apple.com text/html |
CONFIRM support.apple.com/kb/HT213488 |
| Full Disclosure: APPLE-SA-2022-10-27-7 Additional information for APPLE-SA-2022-09-12-4 macOS Monterey 12.6 | seclists.org text/html |
FULLDISC 20221030 APPLE-SA-2022-10-27-7 Additional information for APPLE-SA-2022-09-12-4 macOS Monterey 12.6 |
| Full Disclosure: APPLE-SA-2022-10-24-2 macOS Ventura 13 | seclists.org text/html |
FULLDISC 20221030 APPLE-SA-2022-10-24-2 macOS Ventura 13 |
| Access of Memory Location Before Start of Buffer vulnerability found in vim | huntr.dev text/html |
CONFIRM huntr.dev/bounties/8b36db58-b65c-4298-be7f-40b9e37fd161 |
| patch 8.2.4206: condition with many "(" causes a crash · vim/[email protected] · GitHub | github.com text/html |
MISC github.com/vim/vim/commit/fe6fb267e6ee5c5da2f41889e4e0e0ac5bf4b89d |
Related QID Numbers
- 179292 Debian Security Update for vim (DLA 3011-1)
- 181198 Debian Security Update for vim (DLA 3182-1)
- 282294 Fedora Security Update for vim (FEDORA-2022-f05f9c155b)
- 282322 Fedora Security Update for vim (FEDORA-2022-7e9e1ae1fb)
- 353167 Amazon Linux Security Advisory for vim : ALAS-2022-1567
- 353172 Amazon Linux Security Advisory for vim : ALAS2-2022-1751
- 354421 Amazon Linux Security Advisory for vim : ALAS2022-2022-023
- 354497 Amazon Linux Security Advisory for vim : ALAS2022-2022-155
- 354585 Amazon Linux Security Advisory for vim : ALAS-2022-155
- 671458 EulerOS Security Update for vim (EulerOS-SA-2022-1441)
- 671465 EulerOS Security Update for vim (EulerOS-SA-2022-1462)
- 671553 EulerOS Security Update for vim (EulerOS-SA-2022-1553)
- 671585 EulerOS Security Update for vim (EulerOS-SA-2022-1591)
- 671633 EulerOS Security Update for vim (EulerOS-SA-2022-1669)
- 671639 EulerOS Security Update for vim (EulerOS-SA-2022-1655)
- 671650 EulerOS Security Update for vim (EulerOS-SA-2022-1769)
- 710607 Gentoo Linux Vim, gVim Multiple Vulnerabilities (GLSA 202208-32)
- 751791 SUSE Enterprise Linux Security Update for vim (SUSE-SU-2022:0736-1)
- 751809 OpenSUSE Security Update for vim (openSUSE-SU-2022:0736-1)
- 752246 SUSE Enterprise Linux Security Update for vim (SUSE-SU-2022:2102-1)
- 753066 SUSE Enterprise Linux Security Update for vim (SUSE-SU-2022:4619-1)
Exploit/POC from Github
Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2. CVE project by @Sn0wAlice
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Apple | Macos | All | All | All | All |
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Application | Vim | Vim | All | All | All | All |
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*:
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*:
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*:
- cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*:
No vendor comments have been submitted for this CVE
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @huntrHacktivity |
Access of Memory Location Before Start of Buffer in github.com/vim/vim (CVE-2022-0351) reported by alkyne - Pa… twitter.com/i/web/status/1… | 2022-01-24 19:01:36 |
| @CVEreport |
CVE-2022-0351 : Access of Memory Location Before Start of Buffer in Conda vim prior to 8.2.... cve.report/CVE-2022-0351 | 2022-01-25 18:08:38 |
| @Robo_Alerts |
Potentially Critical CVE Detected! CVE-2022-0351 Description: Access of Memory Location Before Start of Buffer in C… twitter.com/i/web/status/1… | 2022-01-25 18:56:15 |
| @OpenSourceHacks |
(CVE-2022-0351): Access of Memory Location Before Start of Buffer in vim/vim. huntr.dev/bounties/8b36d… Disclosed b… twitter.com/i/web/status/1… | 2022-01-25 19:04:14 |
 /r/k12cybersecurity |
MS-ISAC CYBERSECURITY ADVISORY - Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution - PATCH: NOW | 2022-10-27 12:48:22 |