Linux · Security advisory · February 1, 2022

RLSA-2022:0366: vim security update

RLSA-2022:0366, released February 1, 2022, fixes 5 CVEs in vim (version 2:8.0.1763-16.el8_5.4). None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0193

80th percentile

Priority of the 5 CVEs

Patch now 0
                                Urgent 0
                                High 5
                                Routine 0

Fixed package versions

Product	Release	Fixed in
vim	rocky 8	2:8.0.1763-16.el8_5.4

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2021-4019	vim-common: Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: heap-based buffer o...	7.8	0.0193	None reported
High	CVE-2021-4193	vim-runtime: vim is vulnerable to Out-of-bounds Read	7.8	0.0189	None reported
High	CVE-2021-4192	vim-enhanced: Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: heap-based buffer o...	7.8	0.0185	None reported
High	CVE-2021-3984	vim-gtk: vim is vulnerable to Heap-based Buffer Overflow	7.8	0.0157	None reported
High	CVE-2021-3872	vim-common: Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: heap-based buffer o...	7.8	0.0149	None reported

Also fixes CVE-2021-4019

ALAS2023-2023-098
vim-common, vim-common-debuginfo, vim-data and 8 more on amzn 2023
ELSA-2022-0366
vim-X11, vim-common, vim-enhanced and 2 more on ol 8
ALSA-2022:0366
vim-X11, vim-common, vim-enhanced and 2 more on almalinux 8
RHSA-2022:0366
vim-X11, vim-common, vim-enhanced and 2 more on RHEL 8
vim 2:8.0.1453-1ubuntu1.8
vim on Ubuntu 18.04.6 LTS (bionic)
vim 2:8.1.2269-1ubuntu5.6
vim on Ubuntu 20.04 LTS (focal)
vim-athena 2:8.0.1453-1ubuntu1.8
vim-athena on Ubuntu 18.04.6 LTS (bionic)
vim-athena 2:8.1.2269-1ubuntu5.6
vim-athena on Ubuntu 20.04 LTS (focal)

Vendor advisory

https://errata.rockylinux.org/RLSA-2022:0366

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo