Oracle Linux: CVE-2022-1154: ELSA-2022-5242: vim security update (MODERATE) (Multiple Advisories)
Description
Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646. A heap use-after-free vulnerability was found in Vim's utf_ptr2char() function of the src/mbyte.c file. This flaw occurs because vim is using a buffer line after it has been freed in the old regexp engine. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering a heap use-after-free that causes an application to crash, possibly executing code and corrupting memory.
Solution(s)
- oracle-linux-upgrade-pcp-export-pcp2influxdb
- oracle-linux-upgrade-vim-common
- oracle-linux-upgrade-vim-enhanced
- oracle-linux-upgrade-vim-filesystem
- oracle-linux-upgrade-vim-minimal
- oracle-linux-upgrade-vim-x11
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center