It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-155 advisory.

    A use-after-free vulnerability was found in vim's do_cmdline() function of the src/ex_docmd.c file. The     issue triggers when an invalid line number on :for is ignored. This flaw allows an attacker to trick a     user into opening a specially crafted file, triggering use-after-free that causes an application to crash,     possibly executing code and corrupting memory. (CVE-2022-3099)

    A heap use-after-free vulnerability was found in vim's do_tag() function of the src/tag.c file. The issue     triggers when the 'tagfunc' closes the window. This flaw allows an attacker to trick a user into opening a     specially crafted file, triggering a heap use-after-free that causes an application to crash, possibly     executing code and corrupting memory. (CVE-2022-3134)

    NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. (CVE-2022-3153)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-8622ebdebb advisory.

    The newest upstream commit

    Security fix for CVE-2022-0629

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - vim is vulnerable to Out-of-bounds Read (CVE-2021-4166, CVE-2021-4193)

  - vim is vulnerable to Use After Free (CVE-2021-4192)

  - vim is vulnerable to Heap-based Buffer Overflow (CVE-2022-0213)

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. (CVE-2022-0261, CVE-2022-0359,     CVE-2022-0361, CVE-2022-0572)

  - Heap-based Buffer Overflow in vim/vim prior to 8.2. (CVE-2022-0318)

  - Out-of-bounds Read in vim/vim prior to 8.2. (CVE-2022-0319)

  - Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.
    (CVE-2022-0351)

  - Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. (CVE-2022-0368)

  - Heap-based Buffer Overflow in GitHub repository vim prior to 8.2. (CVE-2022-0392)

  - Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. (CVE-2022-0408, CVE-2022-0629)

  - Use After Free in GitHub repository vim/vim prior to 8.2. (CVE-2022-0413, CVE-2022-0443)

  - Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2. (CVE-2022-0417)

  - Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2. (CVE-2022-0554)

  - Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418. (CVE-2022-0685)

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436. (CVE-2022-0714)

  - Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. (CVE-2022-0729)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1771 advisory.

    A flaw was found in vim that causes an out-of-range pointer offset vulnerability. This flaw allows an     attacker to input a specially crafted file, leading to a crash or code execution. (CVE-2022-0554)

    A heap-based buffer overflow flaw was found in vim's ex_retab() function of indent.c file. This flaw     occurs when repeatedly using :retab. This flaw allows an attacker to trick a user into opening a crafted     file triggering a heap-overflow. (CVE-2022-0572)

    A stack-based buffer overflow flaw was found in vim's ga_concat_shorten_esc() function of src/testing.c     file. This flaw allows an attacker to trick a user into opening a crafted file, triggering a stack-     overflow. This issue can lead to an application crash, causing a denial of service. (CVE-2022-0629)

    A flaw was found in vim. The vulnerability occurs due to a crash when using a special multi-byte character     and leads to an out-of-range vulnerability. This flaw allows an attacker to input a specially crafted     file, leading to a crash or code execution. (CVE-2022-0685)

    A NULL pointer dereference flaw was found in vim's find_ucmd() function of usercmd.c file. This flaw     allows an attacker to trick a user into opening a crafted file, triggering a NULL pointer dereference.
    This issue leads to an application crash, causing a denial of service. (CVE-2022-0696)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Out-of-bounds Read in vim/vim prior to 8.2. (CVE-2022-0319)

  - Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2. (CVE-2022-0554)

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. (CVE-2022-0572)

  - Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. (CVE-2022-0629)

  - Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418. (CVE-2022-0685)

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436. (CVE-2022-0714)

  - Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. (CVE-2022-0729)

  - Heap-based Buffer Overflow occurs in vim in GitHub repository vim/vim prior to 8.2.4563. (CVE-2022-0943)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3204 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3204-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Helmut Grohne     November 24, 2022                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : vim     Version        : 2:8.1.0875-5+deb10u4     CVE ID         : CVE-2022-0318 CVE-2022-0392 CVE-2022-0629 CVE-2022-0696                      CVE-2022-1619 CVE-2022-1621 CVE-2022-1785 CVE-2022-1897                      CVE-2022-1942 CVE-2022-2000 CVE-2022-2129 CVE-2022-3235                      CVE-2022-3256 CVE-2022-3352

    This update fixes multiple memory access violations in vim.

    CVE-2022-0318

        Heap-based Buffer Overflow

    CVE-2022-0392

        Heap-based Buffer Overflow

    CVE-2022-0629

        Stack-based Buffer Overflow

    CVE-2022-0696

        NULL Pointer Dereference

    CVE-2022-1619

        Heap-based Buffer Overflow in function cmdline_erase_chars.  This         vulnerabilities are capable of crashing software, modify memory, and         possible remote execution

    CVE-2022-1621

        Heap buffer overflow in vim_strncpy find_word. This vulnerability is         capable of crashing software, Bypass Protection Mechanism, Modify         Memory, and possible remote execution

    CVE-2022-1785

        Out-of-bounds Write

    CVE-2022-1897

        Out-of-bounds Write

    CVE-2022-1942

        Heap-based Buffer Overflow

    CVE-2022-2000

        Out-of-bounds Write

    CVE-2022-2129

        Out-of-bounds Write

    CVE-2022-3235

        Use After Free

    CVE-2022-3256

        Use After Free

    CVE-2022-3352

        Use After Free

    For Debian 10 buster, these problems have been fixed in version     2:8.1.0875-5+deb10u4.

    We recommend that you upgrade your vim packages.

    For the detailed security status of vim please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/vim

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
166352	Amazon Linux 2022 : vim-common, vim-data, vim-default-editor (ALAS2022-2022-155)	Nessus	Amazon Linux Local Security Checks	2022/10/20	2024/12/11	critical
173115	Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-098)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2024/12/11	critical
158257	Fedora 35 : vim (2022-8622ebdebb)	Nessus	Fedora Local Security Checks	2022/2/22	2024/11/14	high
163127	EulerOS Virtualization 2.10.0 : vim (EulerOS-SA-2022-2042)	Nessus	Huawei Local Security Checks	2022/7/14	2023/10/18	critical
159565	Amazon Linux 2 : vim (ALAS-2022-1771)	Nessus	Amazon Linux Local Security Checks	2022/4/6	2024/12/11	high
162246	EulerOS 2.0 SP9 : vim (EulerOS-SA-2022-1880)	Nessus	Huawei Local Security Checks	2022/6/15	2023/10/20	high
168183	Debian dla-3204 : vim - security update	Nessus	Debian Local Security Checks	2022/11/24	2025/1/22	critical

検出

プラグインの検索

critical

critical

high

critical

high

high

critical