CVE-2022-2345.json

{
  "mitigation": "Do not run untrusted vim scripts as it's not recommended.",
  "affected_release": null,
  "package_state": [
    {
      "product_name": "Red Hat Enterprise Linux 6",
      "fix_state": "Out of support scope",
      "package_name": "vim",
      "cpe": "cpe:/o:redhat:enterprise_linux:6"
    },
    {
      "product_name": "Red Hat Enterprise Linux 7",
      "fix_state": "Out of support scope",
      "package_name": "vim",
      "cpe": "cpe:/o:redhat:enterprise_linux:7"
    },
    {
      "product_name": "Red Hat Enterprise Linux 8",
      "fix_state": "Will not fix",
      "package_name": "vim",
      "cpe": "cpe:/o:redhat:enterprise_linux:8"
    },
    {
      "product_name": "Red Hat Enterprise Linux 9",
      "fix_state": "Will not fix",
      "package_name": "vim",
      "cpe": "cpe:/o:redhat:enterprise_linux:9"
    }
  ],
  "threat_severity": "Low",
  "public_date": "2022-07-05T00:00:00Z",
  "bugzilla": {
    "description": "use-after-free in skipwhite() in charset.c",
    "id": "2106775",
    "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2106775"
  },
  "cvss": {
    "cvss_base_score": "",
    "cvss_scoring_vector": "",
    "status": ""
  },
  "cvss3": {
    "cvss3_base_score": "7.8",
    "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
    "status": "draft"
  },
  "iava": "",
  "cwe": "CWE-416",
  "statement": "Red Hat Product Security has rated this issue as having a Low security impact because the user has to run an untrusted file IN SCRIPT MODE. Someone who is running untrusted files in script mode is equivalent to someone just taking a random python script and running it.\nFor additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/ and Red Hat Enterprise Linux Life Cycle \u0026 Updates Policy: https://access.redhat.com/support/policy/updates/errata/.",
  "acknowledgement": "",
  "name": "CVE-2022-2345",
  "document_distribution": "",
  "details": [
    "Use After Free in GitHub repository vim/vim prior to 9.0.0046.",
    "A use-after-free vulnerability was found in Vim in the skipwhite function in the charset.c file. This issue occurs because an already freed memory is used when a specially crafted input is processed. This flaw allows an attacker who can trick a user into opening a specially crafted file into triggering the use-after-free, and cause the application to crash, possibly executing code and corrupting memory."
  ],
  "references": [
    "https://www.cve.org/CVERecord?id=CVE-2022-2345\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-2345"
  ]
}