Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2022-1619: Vim before 8.2.4899 can crash or run code
CVE-2022-1619 · published 4 years ago
Summary
Versions of Vim in Debian, Fedora, NetApp HCI Management Node and other Linux distributions that are earlier than 8.2.4899 have a coding mistake that can corrupt memory. This can cause the program to stop working, change data it shouldn't, or possibly let an attacker run commands on the system. Upgrade Vim to version 8.2.4899 or later, or apply the security updates provided by your operating‑system vendor.
What to do
- Update debian vim to version 2:9.0.0135-1.
- Update vim to version 8.2.4969-r0.
- Update vim vim to version 8.2.4899 or later.
- Update apple macos to version 13.0 or later.
- Update vim vim/vim to version 8.2.4899 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | vim |
< 2:9.0.0135-1 Fix: upgrade to 2:9.0.0135-1
|
| Debian:13 | debian | vim |
< 2:9.0.0135-1 Fix: upgrade to 2:9.0.0135-1
|
| Debian:14 | debian | vim |
< 2:9.0.0135-1 Fix: upgrade to 2:9.0.0135-1
|
| – | netapp | hci_management_node |
All versions
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* |
| – | vim | vim |
< 8.2.4899 cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
34 35 36 cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* |
| – | debian | debian_linux |
9.0 10.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| – | netapp | solidfire |
All versions
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* |
| – | apple | macos |
< 13.0 cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* |
| – | vim | vim/vim | < 8.2.4899 |
| Alpine:v3.16 | – | vim |
< 8.2.4969-r0 Fix: upgrade to 8.2.4969-r0
|
Original advisory text
Heap-based Buffer Overflow in function cmdline_erase_chars in vim/vim
Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution
References
- https://huntr.dev/bounties/b3200483-624e-4c76-a070-e246f62a7450 URL
- https://security-tracker.debian.org/tracker/CVE-2022-1619 Vendor Advisory
- https://support.apple.com/kb/HT213488 URL
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
- https://security.alpinelinux.org/vuln/CVE-2022-1619 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1619.j... Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-1619 Vendor Advisory
- https://security.gentoo.org/glsa/202208-32 Vendor Advisory
- https://security.gentoo.org/glsa/202305-16 Vendor Advisory
- https://security.netapp.com/advisory/ntap-20220930-0007/ Vendor Advisory
- https://github.com/vim/vim/commit/ef02f16609ff0a26ffc6e20263523424980898fe Patch
- http://seclists.org/fulldisclosure/2022/Oct/28 Third Party Advisory
- http://seclists.org/fulldisclosure/2022/Oct/41 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/05/msg00022.html Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
7.8
High
Type
CWE-122Heap-based Buffer Overflow
CWE-787Out-of-bounds Write
Timeline
Published8 May 2022
Updated4 Nov 2026
First seen22 Jul 2026
Sources
CVE-2022-1619 · OSV
CVE-2022-1619 · NVD
DEBIAN-CVE-2022-1619 · OSV
CVE-2022-1619 · MITRE
ALPINE-CVE-2022-1619 · OSV
Track software like this
Free during beta