[USN-5433-1] Vim vulnerabilities


========================================================================== Ubuntu Security Notice USN-5433-1 May 23, 2022
vim vulnerabilities ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 16.04 ESM
Summary:
Several security issues were fixed in Vim.
Software Description: – vim: Vi IMproved – enhanced vi editor
Details:
It was discovered that Vim incorrectly handled parsing of filenames in its search functionality. If a user were tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service. (CVE-2021-3973)
It was discovered that Vim incorrectly handled memory when opening and searching the contents of certain files. If a user were tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. (CVE-2021-3974)
It was discovered that Vim incorrectly handled memory when opening and editing certain files. If a user were tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. (CVE-2021-3984, CVE-2021-4019, CVE-2021-4069)
It was discovered that Vim was using freed memory when dealing with regular expressions inside a visual selection. If a user were tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. (CVE-2021-4192)
It was discovered that Vim was incorrectly performing read and write operations when in visual block mode, going beyond the end of a line and causing a heap buffer overflow. If a user were tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. (CVE-2022-0261, CVE-2022-0318)
It was discovered that Vim was using freed memory when dealing with regular expressions through its old regular expression engine. If a user were tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. (CVE-2022-1154)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04 ESM:   vim                             2:7.4.1689-3ubuntu1.5+esm4
In general, a standard system update will make all the necessary changes.
References:   ubuntu.com/security/notices/USN-5433-1   CVE-2021-3973, CVE-2021-3974, CVE-2021-3984, CVE-2021-4019,   CVE-2021-4069, CVE-2021-4192, CVE-2022-0261, CVE-2022-0318,   CVE-2022-1154