CVE-2021-3927 (https://huntr.dev/bounties/9c2b2c82-48bb-4be9-ab8f-a48ea252d1b0): vim is vulnerable to Heap-based Buffer Overflow CVE-2021-3928 (https://huntr.dev/bounties/29c3ebd2-d601-481c-bf96-76975369d0cd): vim is vulnerable to Stack-based Buffer Overflow
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=22c80816b550543e1eb073749c320717185ad996 commit 22c80816b550543e1eb073749c320717185ad996 Author: Vaibhav Rustagi <vaibhavrustagi@google.com> AuthorDate: 2021-11-13 02:01:18 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2021-11-13 03:09:34 +0000 app-editors/gvim: version bump to v8.2.3582. This is needed to resolve CVE-2021-3928 and CVE-2021-3927. Bug: https://bugs.gentoo.org/823473 Signed-off-by: Vaibhav Rustagi <vaibhavrustagi@google.com> Closes: https://github.com/gentoo/gentoo/pull/22924 Signed-off-by: Sam James <sam@gentoo.org> app-editors/gvim/Manifest | 1 + app-editors/gvim/gvim-8.2.3582.ebuild | 383 ++++++++++++++++++++++++++++++++++ 2 files changed, 384 insertions(+) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a98e0fefcf7b04af945bfc2f745a6c03868e8f26 commit a98e0fefcf7b04af945bfc2f745a6c03868e8f26 Author: Vaibhav Rustagi <vaibhavrustagi@google.com> AuthorDate: 2021-11-13 01:59:41 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2021-11-13 03:09:33 +0000 app-editors/vim-core: version bump to v8.2.3582. This is needed to resolve CVE-2021-3928 and CVE-2021-3927. Bug: https://bugs.gentoo.org/823473 Signed-off-by: Vaibhav Rustagi <vaibhavrustagi@google.com> Signed-off-by: Sam James <sam@gentoo.org> app-editors/vim-core/Manifest | 1 + app-editors/vim-core/vim-core-8.2.3582.ebuild | 227 ++++++++++++++++++++++++++ 2 files changed, 228 insertions(+) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3b28a3c967b258254ffcbd0ef2a0ac28ed6ee574 commit 3b28a3c967b258254ffcbd0ef2a0ac28ed6ee574 Author: Vaibhav Rustagi <vaibhavrustagi@google.com> AuthorDate: 2021-11-13 01:57:45 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2021-11-13 03:09:32 +0000 app-editors/vim: version bump to v8.2.3582. This is needed to resolve CVE-2021-3928 and CVE-2021-3927. Bug: https://bugs.gentoo.org/823473 Signed-off-by: Vaibhav Rustagi <vaibhavrustagi@google.com> Signed-off-by: Sam James <sam@gentoo.org> app-editors/vim/Manifest | 1 + app-editors/vim/vim-8.2.3582.ebuild | 349 ++++++++++++++++++++++++++++++++++++ 2 files changed, 350 insertions(+)
GLSA request filed
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/data/glsa.git/commit/?id=2cee523fe648754bae0e4ed2a531da672ac5fa15 commit 2cee523fe648754bae0e4ed2a531da672ac5fa15 Author: GLSAMaker <glsamaker@gentoo.org> AuthorDate: 2022-08-21 01:33:31 +0000 Commit: John Helmert III <ajak@gentoo.org> CommitDate: 2022-08-21 01:40:46 +0000 [ GLSA 202208-32 ] Vim, gVim: Multiple Vulnerabilities Bug: https://bugs.gentoo.org/811870 Bug: https://bugs.gentoo.org/818562 Bug: https://bugs.gentoo.org/819528 Bug: https://bugs.gentoo.org/823473 Bug: https://bugs.gentoo.org/824930 Bug: https://bugs.gentoo.org/828583 Bug: https://bugs.gentoo.org/829658 Bug: https://bugs.gentoo.org/830106 Bug: https://bugs.gentoo.org/830994 Bug: https://bugs.gentoo.org/833572 Bug: https://bugs.gentoo.org/836432 Bug: https://bugs.gentoo.org/851231 Signed-off-by: GLSAMaker <glsamaker@gentoo.org> Signed-off-by: John Helmert III <ajak@gentoo.org> glsa-202208-32.xml | 168 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 168 insertions(+)
GLSA released, all done!
