Bug 31239 - vim new security issue CVE-2022-4141
Summary: vim new security issue CVE-2022-4141
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2022-12-07 18:28 CET by David Walser
Modified: 2022-12-28 17:52 CET (History)
5 users (show)

See Also:
Source RPM: vim-9.0.828-1.mga8.src.rpm
CVE: CVE-2022-4141
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2022-12-07 18:28:55 CET 
Fedora has issued an advisory today (December 7):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/AZ3JMSUCR6Y7626RDWQ2HNSUFIQOJ33G/

The issue is fixed upstream in 9.0.0947.
David Walser 2022-12-07 18:29:09 CET

Status comment: (none) => Fixed upstream in 9.0.0947

Comment 1 Lewis Smith 2022-12-07 20:59:35 CET 
v9.0.963 is in Cauldron, but do not know whether it is relevant.
Assigning to tv who looks after vim.

Assignee: bugsquad => thierry.vignaud

Comment 2 Nicolas Salguero 2022-12-08 11:49:25 CET 
Suggested advisory:
========================

The updated packages fix a security vulnerability:

Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command. (CVE-2022-4141)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4141
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/AZ3JMSUCR6Y7626RDWQ2HNSUFIQOJ33G/
========================

Updated packages in core/updates_testing:
========================
vim-common-9.0.963-1.mga8
vim-enhanced-9.0.963-1.mga8
vim-minimal-9.0.963-1.mga8
vim-X11-9.0.963-1.mga8

from SRPM:
vim-9.0.963-1.mga8.src.rpm

CC: (none) => nicolas.salguero
CVE: (none) => CVE-2022-4141
Status: NEW => ASSIGNED
Assignee: thierry.vignaud => qa-bugs
Status comment: Fixed upstream in 9.0.0947 => (none)

Comment 3 Herman Viaene 2022-12-09 14:01:37 CET 
MGA8-64 MATE on Acer Aspire 5253
No installation issues
Muddled around with basic commands as a, d, i, x.
Wrote changes to the file and exited OK.
Good enough for me.

Whiteboard: (none) => MGA8-64-OK
CC: (none) => herman.viaene

Comment 4 Thomas Andrews 2022-12-10 14:22:14 CET 
Validating. Advisory in comment 2.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Dave Hodgins 2022-12-13 02:45:30 CET

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 5 Mageia Robot 2022-12-13 23:11:10 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0464.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.