UbuntuUpdates.org

Package "vim-gui-common"

Name: vim-gui-common

Description:

Vi IMproved - Common GUI files

Latest version: 2:8.1.2269-1ubuntu5.9
Release: focal (20.04)
Level: security
Repository: universe
Head package: vim
Homepage: https://www.vim.org/

Links


Download "vim-gui-common"


Other versions of "vim-gui-common" in Focal

Repository Area Version
base universe 2:8.1.2269-1ubuntu5
updates universe 2:8.1.2269-1ubuntu5.9
proposed universe 2:8.1.2269-1ubuntu5.10

Changelog

Version: 2:8.1.2269-1ubuntu5.9 2022-09-19 15:07:07 UTC

  vim (2:8.1.2269-1ubuntu5.9) focal-security; urgency=medium

  * No-change rebuild to republish missing architecture binaries in the
    security pocket (LP: #1989973)

 -- Nishit Majithia <email address hidden> Mon, 19 Sep 2022 10:29:57 +0530

Source diff to previous version
1989973 focal: Vim 2:8.1.2269-1ubuntu5.8 failed to build for arm32, makes it uninstallable without explicit version

Version: 2:8.1.2269-1ubuntu5.8 2022-09-15 12:07:05 UTC

  vim (2:8.1.2269-1ubuntu5.8) focal-security; urgency=medium

  * SECURITY UPDATE: heap based buffer overflow in spelling suggestion
    function
    - debian/patches/CVE-2022-0943.patch: adjust "badlen".
    - CVE-2022-0943
  * SECURITY UPDATE: use-after-free when processing regular expressions in old
    engine
    - debian/patches/CVE-2022-1154.patch: after getting mark get the line
      again.
    - CVE-2022-1154
  * SECURITY UPDATE: buffer overflow when using invalid command with composing
    chars
    - debian/patches/CVE-2022-1616.patch: check that the whole character fits
      in the buffer.
    - CVE-2022-1616
  * SECURITY UPDATE: heap buffer overflow when processing CTRL-W in latin1
    encoding
    - debian/patches/CVE-2022-1619.patch: check already being at the start of
      the command line.
    - CVE-2022-1619
  * SECURITY UPDATE: NULL pointer access when using invalid pattern
    - debian/patches/CVE-2022-1620.patch: check for failed regexp program.
    - CVE-2022-1620
  * SECURITY UPDATE: heap buffer overflow when processing invalid character
    added to word list
    - debian/patches/CVE-2022-1621.patch: check for a valid word string.
    - debian/patches/remove_test_spell_single_word.patch: removal of test
      test_spell_single_word from src/testdir/test_spell.vim
    - CVE-2022-1621

 -- Nishit Majithia <email address hidden> Tue, 13 Sep 2022 19:18:19 +0530

Source diff to previous version
CVE-2022-0943 Heap-based Buffer Overflow occurs in vim in GitHub repository vim/vim prior to 8.2.4563.
CVE-2022-1154 Use after free in utf_ptr2char in GitHub repository vim/vim prior to 8.2.4646.
CVE-2022-1616 Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protectio
CVE-2022-1619 Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashi
CVE-2022-1620 NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in
CVE-2022-1621 Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Byp

Version: 2:8.1.2269-1ubuntu5.7 2022-02-02 04:06:26 UTC

  vim (2:8.1.2269-1ubuntu5.7) focal-security; urgency=medium

  * No-change rebuild to fix cdimage build on riscv64

 -- Ray Veldkamp <email address hidden> Tue, 01 Feb 2022 20:16:32 +1100

Source diff to previous version

Version: 2:8.1.2269-1ubuntu5.6 2022-01-21 05:06:24 UTC

  vim (2:8.1.2269-1ubuntu5.6) focal-security; urgency=medium

  * SECURITY UPDATE: Use-after-free issue in regular expression engine when
    using a mark, could lead to a denial of service or code execution.
    - debian/patches/CVE-2021-3974.patch: Ensure check for free is made when
      processing mark in src/regexp_nfa.c, src/testdir/test_regexp_latin.vim
    - CVE-2021-3974

  * SECURITY UPDATE: Heap-based buffer overflow could lead to a denial of
    service or possible code execution when C-indenting
    - debian/patches/CVE-2021-3984.patch: Fix memory access issue by correctly
      dereferencing cursor position in src/cindent.c and
      src/testdir/test_cindent.vim
    - CVE-2021-3984

  * SECURITY UPDATE: Heap-based buffer overflow could lead to a denial of
    service when help functions are provided with long command strings
    - debian/patches/CVE-2021-4019.patch: Fix handling of strcpy to use safer
      vim_snprintf in src/ex_cmds.c and src/testdir/test_help.vim
    - CVE-2021-4019

  * SECURITY UPDATE: Use-after-free issue in open command can lead to a denial
    of service or possible code execution
    - debian/patches/CVE-2021-4069.patch: Fix issue making a copy of the
      current line and its address in src/ex_docmd.c
    - CVE-2021-4069

 -- Ray Veldkamp <email address hidden> Thu, 20 Jan 2022 22:59:01 +1100

Source diff to previous version
CVE-2021-3974 vim is vulnerable to Use After Free
CVE-2021-3984 vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-4019 vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-4069 vim is vulnerable to Use After Free

Version: 2:8.1.2269-1ubuntu5.4 2021-11-15 15:07:22 UTC

  vim (2:8.1.2269-1ubuntu5.4) focal-security; urgency=medium

  * SECURITY UPDATE: Fix heap-based buffer overflow when buffer name is very
    long
    - debian/patches/CVE-2021-3872.patch: Make sure not to go over the end of
      the buffer in src/drawscreen.c, src/testdir/test_statusline.vim.
    - CVE-2021-3872
  * SECURITY UPDATE: Fix heap-based buffer overflow when scrolling without a
    valid screen
    - debian/patches/CVE-2021-3903.patch: Do not set VALID_BOTLINE in w_valid
      in src/move.c, src/testdir/test_normal.vim.
    - CVE-2021-3903
  * SECURITY UPDATE: Fix heap-based buffer overflow when reading character
    past end of line
    - debian/patches/CVE-2021-3927.patch: Correct the cursor column in
      src/ex_docmd.c, src/testdir/test_put.vim.
    - CVE-2021-3927
  * SECURITY UPDATE: Fix stack-based buffer overflow when reading
    uninitialized memory when giving spell suggestions
    - debian/patches/CVE-2021-3928.patch: Check that preword is not empty in
      src/spellsuggest.c, src/testdir/test_spell.vim.
    - CVE-2021-3928
  * Fix flaky vim terminal mode test

 -- Spyros Seimenis <email address hidden> Mon, 08 Nov 2021 15:21:34 +0100

CVE-2021-3872 vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3903 vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3927 vim is vulnerable to Heap-based Buffer Overflow
CVE-2021-3928 vim is vulnerable to Stack-based Buffer Overflow



About   -   Send Feedback to @ubuntu_updates