CVE-2021-4166

Publication date 25 December 2021

Last updated 24 July 2024

Ubuntu priority

Why this priority?

Cvss 3 Severity Score

Score breakdown

vim is vulnerable to Out-of-bounds Read

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
vim	22.10 kinetic	Not affected
	22.04 LTS jammy	Not affected
	21.10 impish	Ignored end of life
	21.04 hirsute	Ignored end of life
	20.04 LTS focal	Fixed 2:8.1.2269-1ubuntu5.14
	18.04 LTS bionic	Ignored see notes
	16.04 LTS xenial	Ignored see notes
	14.04 LTS trusty	Ignored end of ESM support, was ignored [see notes]

Notes

ccdm94

code in bionic and earlier does not include file src/arglist.c, which is the patched file. The patched code for these releases seems to be instead present in src/buffer.c, as seen in commit 4ad62155a10. Changes that led to the creation of file arglist.c and changes made to the code that follow the creation of this file are significant, which would result in an intrusive backport should the altered CVE patch and other necessary changes be applied in bionic and earlier. Consequently, the issue will be marked as ignored for the previously mentioned releases.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
vim	Upstream: 6f98371

Severity score breakdown

Parameter	Value
Base score	7.1 · High
Attack vector	Local
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H