USN-5247-1: Vim vulnerabilities

Releases

• Ubuntu 21.10
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• vim - Vi IMproved - enhanced vi editor

Details

It was discovered that vim incorrectly handled parsing of filenames in its
search functionality. If a user was tricked into opening a specially crafted
file, an attacker could crash the application, leading to a denial of
service. This issue only affected Ubuntu 21.10. (CVE-2021-3973)

It was discovered that vim incorrectly handled memory when opening and
searching the contents of certain files. If a user was tricked into opening
a specially crafted file, an attacker could crash the application, leading to
a denial of service, or possibly achieve code execution with user privileges.
This issue only affected Ubuntu 20.04 LTS and Ubuntu 21.10. (CVE-2021-3974)

It was discovered that vim incorrectly handled memory when opening and editing
certain files. If a user was tricked into opening a specially crafted file, an
attacker could crash the application, leading to a denial of service, or
possibly achieve code execution with user privileges. (CVE-2021-3984)

It was discovered that vim incorrectly handled memory when opening and editing
certain files. If a user was tricked into opening a specially crafted file, an
attacker could crash the application, leading to a denial of service, or
possibly achieve code execution with user privileges. (CVE-2021-4019)

It was discovered that vim incorrectly handled memory when opening and editing
certain files. If a user was tricked into opening a specially crafted file, an
attacker could crash the application, leading to a denial of service, or
possibly achieve code execution with user privileges.(CVE-2021-4069)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 21.10

• vim - 2:8.2.2434-3ubuntu3.2

Ubuntu 20.04

• vim - 2:8.1.2269-1ubuntu5.6

Ubuntu 18.04

• vim - 2:8.0.1453-1ubuntu1.8

In general, a standard system update will make all the necessary changes.

References

• CVE-2021-3974
• CVE-2021-3984
• CVE-2021-4019
• CVE-2021-3973
• CVE-2021-4069

Related notices

• USN-5433-1: vim-athena-py2, vim-gtk3-py2, vim-gtk3, vim-gnome-py2, vim-nox-py2, vim-gui-common, vim-doc, vim-runtime, vim-tiny, vim-gnome, vim-common, vim-gtk, vim-gtk-py2, vim-nox, vim, vim-athena
• USN-6965-1: vim-tiny, vim-runtime, vim-gui-common, vim-doc, vim-gnome, vim-common, vim-lesstif, vim-gtk, vim-nox, vim, vim-athena