Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 811870 (CVE-2021-3770, CVE-2021-3778, CVE-2021-3796) - <app-editors/vim-8.2.3428 <app-editors/gvim-8.2.3428 <app-editors/vim-core-8.2.3428: heap buffer overflow (CVE-2021-{3770,3778,3796})
Summary: <app-editors/vim-8.2.3428 <app-editors/gvim-8.2.3428 <app-editors/vim-core-8....
Status: RESOLVED FIXED
Alias: CVE-2021-3770, CVE-2021-3778, CVE-2021-3796
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://huntr.dev/bounties/016ad2f2-0...
Whiteboard: B3 [glsa+]
Keywords: PullRequest
Depends on: 825350 816894
Blocks: CVE-2021-3875 CVE-2021-3872 CVE-2021-3927, CVE-2021-3928
  Show dependency tree
 
Reported: 2021-09-06 17:58 UTC by John Helmert III
Modified: 2022-08-21 02:15 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-09-06 17:58:50 UTC
CVE-2021-3770:

vim is vulnerable to Heap-based Buffer Overflow

Patch: https://github.com/vim/vim/commit/b7081e135a16091c93f6f5f7525a5c58fb7ca9f9):

Please bump to at least 8.2.3402.
Comment 1 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-09-15 19:27:52 UTC
Another one with an equal CVE description:

https://github.com/vim/vim/commit/35a9a00afcb20897d462a766793ff45534810dc3

Please bump to at least 8.2.3428.
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-09-18 17:43:49 UTC
Another one with an equal CVE description:

https://github.com/vim/vim/commit/65b605665997fad54ef39a93199e305af2fe4d7f

Still need to bump to >=8.2.3428.
Comment 3 Robert Kolchmeyer 2021-09-30 16:24:22 UTC
I sent a PR for this issue: https://github.com/gentoo/gentoo/pull/22436
Comment 4 Larry the Git Cow gentoo-dev 2021-10-03 21:18:12 UTC
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=38690bc141d7bd4ecd15234f37bfb22ca3b238c9

commit 38690bc141d7bd4ecd15234f37bfb22ca3b238c9
Author:     Robert Kolchmeyer <rkolchmeyer@google.com>
AuthorDate: 2021-09-28 21:38:02 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2021-10-03 21:15:23 +0000

    app-editors/gvim: Version bump (v8.2.3428)
    
    Bug: https://bugs.gentoo.org/811870
    Closes: https://bugs.gentoo.org/811870
    Signed-off-by: Robert Kolchmeyer <rkolchmeyer@google.com>
    Closes: https://github.com/gentoo/gentoo/pull/22436
    Signed-off-by: Sam James <sam@gentoo.org>

 app-editors/gvim/Manifest             |   1 +
 app-editors/gvim/gvim-8.2.3428.ebuild | 378 ++++++++++++++++++++++++++++++++++
 2 files changed, 379 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0e8316bb3a0c6714fb3806cd5d86ba26a373a1d5

commit 0e8316bb3a0c6714fb3806cd5d86ba26a373a1d5
Author:     Robert Kolchmeyer <rkolchmeyer@google.com>
AuthorDate: 2021-09-28 00:45:32 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2021-10-03 21:15:22 +0000

    app-editors/vim: Version bump (v8.2.3428)
    
    Bug: https://bugs.gentoo.org/811870
    Closes: https://bugs.gentoo.org/811870
    Signed-off-by: Robert Kolchmeyer <rkolchmeyer@google.com>
    Signed-off-by: Sam James <sam@gentoo.org>

 app-editors/vim/Manifest            |   1 +
 app-editors/vim/vim-8.2.3428.ebuild | 335 ++++++++++++++++++++++++++++++++++++
 2 files changed, 336 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=06d7d8ab72659b733bfbdadb7ebf64b1109bd86f

commit 06d7d8ab72659b733bfbdadb7ebf64b1109bd86f
Author:     Robert Kolchmeyer <rkolchmeyer@google.com>
AuthorDate: 2021-09-28 20:04:18 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2021-10-03 21:15:21 +0000

    app-editors/vim-core: Version bump (v8.2.3428)
    
    Bug: https://bugs.gentoo.org/811870
    Closes: https://bugs.gentoo.org/811870
    Signed-off-by: Robert Kolchmeyer <rkolchmeyer@google.com>
    Signed-off-by: Sam James <sam@gentoo.org>

 app-editors/vim-core/Manifest                 |   1 +
 app-editors/vim-core/vim-core-8.2.3428.ebuild | 225 ++++++++++++++++++++++++++
 2 files changed, 226 insertions(+)

Additionally, it has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=38690bc141d7bd4ecd15234f37bfb22ca3b238c9

commit 38690bc141d7bd4ecd15234f37bfb22ca3b238c9
Author:     Robert Kolchmeyer <rkolchmeyer@google.com>
AuthorDate: 2021-09-28 21:38:02 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2021-10-03 21:15:23 +0000

    app-editors/gvim: Version bump (v8.2.3428)
    
    Bug: https://bugs.gentoo.org/811870
    Closes: https://bugs.gentoo.org/811870
    Signed-off-by: Robert Kolchmeyer <rkolchmeyer@google.com>
    Closes: https://github.com/gentoo/gentoo/pull/22436
    Signed-off-by: Sam James <sam@gentoo.org>

 app-editors/gvim/Manifest             |   1 +
 app-editors/gvim/gvim-8.2.3428.ebuild | 378 ++++++++++++++++++++++++++++++++++
 2 files changed, 379 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0e8316bb3a0c6714fb3806cd5d86ba26a373a1d5

commit 0e8316bb3a0c6714fb3806cd5d86ba26a373a1d5
Author:     Robert Kolchmeyer <rkolchmeyer@google.com>
AuthorDate: 2021-09-28 00:45:32 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2021-10-03 21:15:22 +0000

    app-editors/vim: Version bump (v8.2.3428)
    
    Bug: https://bugs.gentoo.org/811870
    Closes: https://bugs.gentoo.org/811870
    Signed-off-by: Robert Kolchmeyer <rkolchmeyer@google.com>
    Signed-off-by: Sam James <sam@gentoo.org>

 app-editors/vim/Manifest            |   1 +
 app-editors/vim/vim-8.2.3428.ebuild | 335 ++++++++++++++++++++++++++++++++++++
 2 files changed, 336 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=06d7d8ab72659b733bfbdadb7ebf64b1109bd86f

commit 06d7d8ab72659b733bfbdadb7ebf64b1109bd86f
Author:     Robert Kolchmeyer <rkolchmeyer@google.com>
AuthorDate: 2021-09-28 20:04:18 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2021-10-03 21:15:21 +0000

    app-editors/vim-core: Version bump (v8.2.3428)
    
    Bug: https://bugs.gentoo.org/811870
    Closes: https://bugs.gentoo.org/811870
    Signed-off-by: Robert Kolchmeyer <rkolchmeyer@google.com>
    Signed-off-by: Sam James <sam@gentoo.org>

 app-editors/vim-core/Manifest                 |   1 +
 app-editors/vim-core/vim-core-8.2.3428.ebuild | 225 ++++++++++++++++++++++++++
 2 files changed, 226 insertions(+)
Comment 5 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-10-03 21:19:00 UTC
Reopening for stabilisation. Thanks for the PR!
Comment 6 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-11-20 17:15:45 UTC
Please cleanup.
Comment 7 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-08-14 05:31:52 UTC
GLSA request filed
Comment 8 Larry the Git Cow gentoo-dev 2022-08-21 02:09:29 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=2cee523fe648754bae0e4ed2a531da672ac5fa15

commit 2cee523fe648754bae0e4ed2a531da672ac5fa15
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2022-08-21 01:33:31 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2022-08-21 01:40:46 +0000

    [ GLSA 202208-32 ] Vim, gVim: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/811870
    Bug: https://bugs.gentoo.org/818562
    Bug: https://bugs.gentoo.org/819528
    Bug: https://bugs.gentoo.org/823473
    Bug: https://bugs.gentoo.org/824930
    Bug: https://bugs.gentoo.org/828583
    Bug: https://bugs.gentoo.org/829658
    Bug: https://bugs.gentoo.org/830106
    Bug: https://bugs.gentoo.org/830994
    Bug: https://bugs.gentoo.org/833572
    Bug: https://bugs.gentoo.org/836432
    Bug: https://bugs.gentoo.org/851231
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 glsa-202208-32.xml | 168 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 168 insertions(+)
Comment 9 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-08-21 02:15:36 UTC
GLSA released, all done!