It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1728 advisory.

    2024-05-09: CVE-2020-20703 was added to this advisory.

    Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the     operand parameter. (CVE-2020-20703)

    A flaw was found in vim. A possible heap-based buffer overflow could allow an attacker to input a     specially crafted file leading to a crash or code execution. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system availability. (CVE-2021-3778)

    A use-after-free vulnerability in vim could allow an attacker to input a specially crafted file leading to     memory corruption and a potentially exploitable crash or code execution. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2021-3796)

    An out-of-bounds write flaw was found in vim's drawscreen.c win_redr_status() function. This flaw allows     an attacker to trick a user to open a crafted file with specific arguments in vim, triggering an out-of-     bounds write. The highest threat from this vulnerability is to confidentiality, integrity, and system     availability. (CVE-2021-3872)

    There's an out-of-bounds read flaw in Vim's ex_docmd.c. An attacker who is capable of tricking a user into     opening a specially crafted file could trigger an out-of-bounds read on a memmove operation, potentially     causing an impact to application availability. (CVE-2021-3875)

    A flaw was found in vim. A possible heap use-after-free vulnerability could allow an attacker to input a     specially crafted file leading to a crash or code execution. The highest threat from this vulnerability is     to system availability. (CVE-2021-3968)

    A flaw was found in vim. A possible heap-based buffer overflow could allow an attacker to input a     specially crafted file leading to a crash or code execution. The highest threat from this vulnerability is     to system availability. (CVE-2021-3973)

    A flaw was found in vim. A possible use-after-free vulnerability could allow an attacker to input a     specially crafted file leading to a crash or code execution. The highest threat from this vulnerability is     to system availability. (CVE-2021-3974)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1557 advisory.

    2024-05-09: CVE-2020-20703 was added to this advisory.

    Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the     operand parameter. (CVE-2020-20703)

    vim is vulnerable to Heap-based Buffer Overflow (CVE-2021-3903)

    A flaw was found in vim. A possible heap-based buffer overflow could allow an attacker to input a     specially crafted file leading to a crash or code execution. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system availability. (CVE-2021-3927)

    A flaw was found in vim. A possible stack-based buffer overflow could allow an attacker to input a     specially crafted file leading to a crash or code execution. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system availability. (CVE-2021-3928)

    A flaw was found in vim. A possible heap use-after-free vulnerability could allow an attacker to input a     specially crafted file leading to a crash or code execution. The highest threat from this vulnerability is     to system availability. (CVE-2021-3968)

    A flaw was found in vim. A possible heap-based buffer overflow could allow an attacker to input a     specially crafted file leading to a crash or code execution. The highest threat from this vulnerability is     to system availability. (CVE-2021-3973)

    A flaw was found in vim. A possible use-after-free vulnerability could allow an attacker to input a     specially crafted file leading to a crash or code execution. The highest threat from this vulnerability is     to system availability. (CVE-2021-3974)

    A flaw was found in vim. A possible heap-based buffer overflow allows an attacker to input a specially     crafted file, leading to a crash or code execution. The highest threat from this vulnerability is     confidentiality, integrity, and system availability. (CVE-2021-3984)

    A flaw was found in vim. A possible heap-based buffer overflow vulnerability allows an attacker to input a     specially crafted file, leading to a crash or code execution. The highest threat from this vulnerability     is system availability. (CVE-2021-4019)

    vim is vulnerable to Use After Free (CVE-2021-4069)

    A flaw was found in vim. A possible heap-based buffer overflow could allow an attacker to input a     specially crafted file leading to a crash or code execution. (CVE-2021-4136)

    A flaw was found in vim. A possible heap-based buffer overflow could allow an attacker to input a     specially crafted file leading to a crash or code execution. (CVE-2021-4166)

    A flaw was found in vim. A possible use after free vulnerability could allow an attacker to input a     specially crafted file leading to a crash or code execution. (CVE-2021-4173)

    A flaw was found in vim. A possible use after free vulnerability could allow an attacker to input a     specially crafted file leading to a crash or code execution. (CVE-2021-4187)

    It was found that vim was vulnerable to use-after-free flaw in win_linetabsize(). Sourcing a specially     crafted file in vim could crash the vim process or possibly lead to other undefined behaviors.
    (CVE-2021-4192)

    It was found that vim was vulnerable to an out-of-bound read flaw in getvcol(). A specially crafted file     could be used to, when opened in vim, disclose some of the process's internal memory. (CVE-2021-4193)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2947 advisory.

    Multiple security vulnerabilities have been discovered in vim, an enhanced vi editor. Buffer overflows,     out-of-bounds reads and Null pointer dereferences may lead to a denial of service (application crash) or     other unspecified impact. For Debian 9 stretch, these problems have been fixed in version     2:8.0.0197-4+deb9u5. We recommend that you upgrade your vim packages. For the detailed security status of     vim please refer to its security tracker page at: https://security-tracker.debian.org/tracker/vim Further     information about Debian LTS security advisories, how to apply these updates to your system and frequently     asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

因此，它受到 ALAS2-2021-1728 公告中所提及的多個弱點影響。

  - VIM v.8.1.2135 中的緩衝區溢位弱點允許遠端攻擊者透過運算元參數執行任意程式碼。(CVE-2020-20703)

  - vim 容易受到堆積型緩衝區溢位弱點影響 (CVE-2021-3778、CVE-2021-3872、CVE-2021-3875、CVE-2021-3968、CVE-2021-3973)

  - vim 容易受到釋放後使用弱點影響 (CVE-2021-3796、CVE-2021-3974)

請注意，Nessus 並未測試這些問題，而是僅根據應用程式自我報告的版本號碼作出判斷。

因此，它受到 ALAS-2022-1557 公告中所提及的多個弱點影響。

  - VIM v.8.1.2135 中的緩衝區溢位弱點允許遠端攻擊者透過運算元參數執行任意程式碼。(CVE-2020-20703)

  - vim 容易受到堆積型緩衝區溢位影響 (CVE-2021-3903、 CVE-2021-3927、 CVE-2021-3968、 CVE-2021-3973、 CVE-2021-3984、 CVE-2021-4019、CVE-2021-4136)

  - vim 容易受到使用未初始化變數的影響 (CVE-2021-3928)

  - vim 容易受到釋放後使用弱點影響 (CVE-2021-3974、CVE-2021-4069、CVE-2021-4173、CVE-2021-4187、CVE-2021-4192)

  - vim 容易受到超出邊界讀取弱點影響 (CVE-2021-4166、CVE-2021-4193)

請注意，Nessus 並未測試這些問題，而是僅根據應用程式自我報告的版本號碼作出判斷。

遠端 Debian 9 主機上安裝的多個套件受到 dla-2947 公告中提及的多個弱點影響。

  - vim 容易受到堆積型緩衝區溢位弱點影響 (CVE-2021-3872、CVE-2021-3927、CVE-2021-3973、CVE-2021-3984、CVE-2021-4019、CVE-2022-0213)

  - vim 容易受到使用未初始化變數的影響 (CVE-2021-3928)

  - vim 容易受到釋放後使用弱點影響 (CVE-2021-3974、CVE-2021-4069、CVE-2021-4192)

  - vim 容易受到超出邊界讀取的影響 (CVE-2021-4193)

  - vim/vim 8.2 更舊版本中存在超出邊界讀取弱點。(CVE-2022-0319)

  - GitHub 存放庫 vim/vim 8.2 更早版本中存在堆積型緩衝區溢位弱點。(CVE-2022-0359、CVE-2022-0361)

  - GitHub 存放庫 vim/vim 8.2 更舊版本中存在超出邊界讀取弱點。(CVE-2022-0368)

  - GitHub 存放庫 vim/vim 8.2 更舊版本中存在堆疊型緩衝區溢位弱點。(CVE-2022-0408)

  - GitHub 存放庫 vim/vim 8.2 更舊版本中存在使用超出範圍指標位移弱點。(CVE-2022-0554)

  - GitHub 存放庫 vim/vim 8.2.4418 更舊版本中存在使用超出範圍指標位移弱點。(CVE-2022-0685)

  - GitHub 存放庫 vim/vim 8.2.4436 更早版本中存在堆積型緩衝區溢位弱點。(CVE-2022-0714)

  - GitHub 存放庫 vim/vim 8.2.4440 更舊版本中存在使用超出範圍指標位移弱點。(CVE-2022-0729)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

因此，會受到 ALAS2022-2021-005 公告中所提及的多個弱點影響。

    vim 容易受到堆積型緩衝區溢位影響 (CVE-2021-3903)

    在 vim 中發現一個瑕疵。潛在的堆積型緩衝區溢位可允許攻擊者輸入特製的檔案，進而導致損毀或程式碼執行。此弱點對於資料的機密性和完整性以及系統可用性威脅最大。(CVE-2021-3927)

    在 vim 中發現一個瑕疵。潛在的堆疊型緩衝區溢位可允許攻擊者輸入特製的檔案，進而導致損毀或程式碼執行。此弱點對於資料的機密性和完整性以及系統可用性威脅最大。(CVE-2021-3928)

    在 vim 中發現一個瑕疵。潛在的堆積釋放後使用弱點可允許攻擊者輸入特製的檔案，進而導致損毀或程式碼執行。此弱點對系統可用性威脅最大。(CVE-2021-3968)

    在 vim 中發現一個瑕疵。潛在的堆積型緩衝區溢位可允許攻擊者輸入特製的檔案，進而導致損毀或程式碼執行。此弱點對系統可用性威脅最大。(CVE-2021-3973)

    在 vim 中發現一個瑕疵。潛在的釋放後使用弱點可允許攻擊者輸入特製的檔案，進而導致損毀或程式碼執行。此弱點對系統可用性威脅最大。(CVE-2021-3974)

    在 vim 中發現一個瑕疵。潛在的堆積型緩衝區溢位會允許攻擊者輸入特製的檔案，進而導致損毀或程式碼執行。此弱點對於機密性、完整性以及系統可用性的威脅最大。(CVE-2021-3984)

Tenable 已直接從所測試產品的安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
155982	Amazon Linux 2 : vim (ALAS-2021-1728)	Nessus	Amazon Linux Local Security Checks	2021/12/10	2024/12/11	critical
156877	Amazon Linux AMI : vim (ALAS-2022-1557)	Nessus	Amazon Linux Local Security Checks	2022/1/20	2024/12/11	critical
158978	Debian DLA-2947-1 : vim - LTS security update	Nessus	Debian Local Security Checks	2022/3/16	2025/1/24	high
155982	Amazon Linux 2：vim (ALAS-2021-1728)	Nessus	Amazon Linux Local Security Checks	2021/12/10	2024/12/11	critical
156877	Amazon Linux AMI：vim (ALAS-2022-1557)	Nessus	Amazon Linux Local Security Checks	2022/1/20	2024/12/11	critical
158978	Debian DLA-2947-1：vim - LTS 安全性更新	Nessus	Debian Local Security Checks	2022/3/16	2025/1/24	high
212471	Amazon Linux 2022：vim-common、vim-data、vim-default-editor (ALAS2022-2021-005)	Nessus	Amazon Linux Local Security Checks	2024/12/11	2024/12/12	high

检测

插件搜索

critical

critical

high

critical

critical

high

high