Headline
CVE-2022-0714: patch 8.2.4436: crash with weird 'vartabstop' value · vim/vim@4e889f9
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436.
4 comments on commit 4e889f9
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This test fails on Windows: https://github.com/vim/vim/runs/5279219272?check_suite_focus=true#step:13:7478
Caught exception in Test_vartabstop_latin1(): Vim(set):E950: Cannot convert between cp1252 and iso-8859- @ command line…script D:/a/vim/vim/src/testdir/runtest.vim[456]…function RunTheTest[44]…Test_vartabstop_latin1, line 3
Maybe we should use set encoding=latin1 instead of set encoding=iso8859?
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I created #9818, but it didn’t work as expected…
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
wait a second, is iso8859 actually a valid encoding? Shouldn’t it rather be iso8859-1 e.g. we are missing what kind of a iso-8859 encoding is used (latin1: -1, … latin9: -15, etc)
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ah, that should be better.
Please sign in to comment.
Related news
Ubuntu Security Notice 6026-1 - It was discovered that Vim was incorrectly processing Vim buffers. An attacker could possibly use this issue to perform illegal memory access and expose sensitive information. This issue only affected Ubuntu 20.04 LTS. It was discovered that Vim was using freed memory when dealing with regular expressions inside a visual selection. If a user were tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. This issue only affected Ubuntu 14.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
Dell Streaming Data Platform prior to 1.4 contains Open Redirect vulnerability. An attacker with privileges same as a legitimate user can phish the legitimate the user to redirect to malicious website leading to information disclosure and launch of phishing attacks.
Hello everyone! Great news for my open source Scanvus project! You can now perform vulnerability checks on Linux hosts and docker images not only using the Vulners.com API, but also with the Vulns.io VM API. It’s especially nice that all the code to support the new API was written and contributed by colleagues from Vulns.io. […]
A memory corruption issue existed in the processing of ICC profiles. This issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13. Processing a maliciously crafted image may lead to arbitrary code execution.
Gentoo Linux Security Advisory 202208-32 - Multiple vulnerabilities have been discovered in Vim, the worst of which could result in denial of service. Versions less than 9.0.0060 are affected.
Ubuntu Security Notice 5460-1 - It was discovered that Vim was incorrectly processing Vim buffers. An attacker could possibly use this issue to perform illegal memory access and expose sensitive information. It was discovered that Vim was not properly performing bounds checks for column numbers when replacing tabs with spaces or spaces with tabs, which could cause a heap buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.