vim 先于9.0.0805 autocmd quickfix.c qf_update_buffer 内存损坏

在vim 中曾发现分类为棘手的漏洞。 受此问题影响的是功能qf_update_buffer文件：quickfix.c的组件:autocmd Handler。 手动调试的不合法输入可导致 内存损坏。 使用CWE来声明会导致 CWE-416 的问题。 此漏洞的脆弱性 2022-10-26公示人身份d0fab10ed2a86698937e3c3fed2f10bd9bb5e731、所分享。 公告共享下载网址是github.com。 该漏洞被处理的名称为CVE-2022-3705， 远程可以启动攻击， 有技术细节可用。 没有可利用漏洞。 漏洞利用的当前现价为美元计算大致为USD $0-$5k。 它被宣布为未定义。 估计零日攻击的地下价格约为$0-$5k。 升级到版本9.0.0805能够解决此问题。 补丁名称为d0fab10ed2a86698937e3c3fed2f10bd9bb5e731。 错误修复程序下载地址为github.com， 建议对受到影响的组件升级。 该漏洞被披露后，此前未曾发表过可能的缓解措施。

字段2022-10-26 20時44分2022-11-25 14時58分2022-11-25 15時02分
namevimvimvim
componentautocmd Handlerautocmd Handlerautocmd Handler
filequickfix.cquickfix.cquickfix.c
functionqf_update_bufferqf_update_bufferqf_update_buffer
cwe416 (内存损坏)416 (内存损坏)416 (内存损坏)
risk111
cvss3_vuldb_avNNN
cvss3_vuldb_acHHH
cvss3_vuldb_prNNN
cvss3_vuldb_uiRRR
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aLLL
cvss3_vuldb_rlOOO
cvss3_vuldb_rcCCC
identifierd0fab10ed2a86698937e3c3fed2f10bd9bb5e731d0fab10ed2a86698937e3c3fed2f10bd9bb5e731d0fab10ed2a86698937e3c3fed2f10bd9bb5e731
urlhttps://github.com/vim/vim/commit/d0fab10ed2a86698937e3c3fed2f10bd9bb5e731https://github.com/vim/vim/commit/d0fab10ed2a86698937e3c3fed2f10bd9bb5e731https://github.com/vim/vim/commit/d0fab10ed2a86698937e3c3fed2f10bd9bb5e731
name升级升级升级
upgrade_version9.0.08059.0.08059.0.0805
patch_named0fab10ed2a86698937e3c3fed2f10bd9bb5e731d0fab10ed2a86698937e3c3fed2f10bd9bb5e731d0fab10ed2a86698937e3c3fed2f10bd9bb5e731
patch_urlhttps://github.com/vim/vim/commit/d0fab10ed2a86698937e3c3fed2f10bd9bb5e731https://github.com/vim/vim/commit/d0fab10ed2a86698937e3c3fed2f10bd9bb5e731https://github.com/vim/vim/commit/d0fab10ed2a86698937e3c3fed2f10bd9bb5e731
cveCVE-2022-3705CVE-2022-3705CVE-2022-3705
responsibleVulDBVulDBVulDB
date1666735200 (2022-10-26)1666735200 (2022-10-26)1666735200 (2022-10-26)
typeWord Processing SoftwareWord Processing SoftwareWord Processing Software
cvss2_vuldb_avNNN
cvss2_vuldb_acHHH
cvss2_vuldb_auNNN
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiPPP
cvss2_vuldb_rcCCC
cvss2_vuldb_rlOFOFOF
cvss2_vuldb_eNDNDND
cvss3_vuldb_eXXX
cvss2_vuldb_basescore5.15.15.1
cvss2_vuldb_tempscore4.44.44.4
cvss3_vuldb_basescore5.05.05.0
cvss3_vuldb_tempscore4.84.84.8
cvss3_meta_basescore5.05.05.8
cvss3_meta_tempscore4.84.85.8
price_0day$0-$5k$0-$5k$0-$5k
cve_assigned1666735200 (2022-10-26)1666735200 (2022-10-26)
cve_nvd_summaryA vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix.c of the component autocmd Handler. The manipulation leads to use after free. The attack may be launched remotely. Upgrading to version 9.0.0805 is able to address this issue. The name of the patch is d0fab10ed2a86698937e3c3fed2f10bd9bb5e731. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-212324.A vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix.c of the component autocmd Handler. The manipulation leads to use after free. The attack may be launched remotely. Upgrading to version 9.0.0805 is able to address this issue. The name of the patch is d0fab10ed2a86698937e3c3fed2f10bd9bb5e731. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-212324.
cvss3_nvd_avN
cvss3_nvd_acH
cvss3_nvd_prN
cvss3_nvd_uiR
cvss3_nvd_sU
cvss3_nvd_cH
cvss3_nvd_iH
cvss3_nvd_aH
cvss3_cna_avN
cvss3_cna_acH
cvss3_cna_prN
cvss3_cna_uiR
cvss3_cna_sU
cvss3_cna_cL
cvss3_cna_iL
cvss3_cna_aL
cve_cnaVulDB
cvss3_nvd_basescore7.5
cvss3_cna_basescore5.0

◂ 上一步一览下一步 ▸

Might our Artificial Intelligence support you?

Check our Alexa App!