CVE-2022-4141

Katalog CVE

CVSS 7.8 · High EPSS 0,45%

Kerentanan Heap-based Buffer Overflow pada debian linux, neovim +2 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command.

Rincian

Terbit di NVD

25 November 2022

Terakhir diubah

24 September 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vim/vim/commit/cc762a48d42b579fb7bdec2c614636b830342dd5 patch · advisory pihak ketiga
• https://huntr.dev/bounties/20ece512-c600-45ac-8a84-d0931e05541f exploit · issue tracking · patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/06/msg00015.html mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AZ3JMSUCR6Y76... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6ZNKVN4GICOR... mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202305-16 advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html mailing list · advisory pihak ketiga