CVE-2022-3705 vim autocmd quickfix.c qf_update_buffer use after free
A use-after-free vulnerability in Vim's quickfix buffer update allows remote attackers to potentially execute arbitrary code or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-3705?
CVE-2022-3705 is a medium-severity use after free vulnerability in Debian Debian Linux, published on 26 Oct 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix.c of the component autocmd Handler. The manipulation leads to use after free. The attack may be launched remotely. Upgrading to version 9.0.0805 is able to address this issue. The name of the patch is d0fab10ed2a86698937e3c3fed2f10bd9bb5e731. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-212324.
Which versions are affected by CVE-2022-3705?
It affects 4 products.
Products include Debian Debian Linux, Fedoraproject Fedora, Netapp Active Iq Unified Manager, Vim Vim.
How do I fix CVE-2022-3705?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2022-3705 being exploited?
There is no known exploitation of CVE-2022-3705 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2022-3705, AZL-11358, DEBIAN-CVE-2022-3705, GHSA-vwcr-hcq5-36jr, OESA-2022-2043, UBUNTU-CVE-2022-3705.