824930 – (CVE-2021-3968, CVE-2021-3973, CVE-2021-3974, CVE-2021-3984, CVE-2021-4019) <app-editors/{vim,gvim,vim-core}-8.2.3669: multiple vulnerabilities (CVE-2021-{3968,3973,3974})

Bug 824930 (CVE-2021-3968, CVE-2021-3973, CVE-2021-3974, CVE-2021-3984, CVE-2021-4019) - <app-editors/{vim,gvim,vim-core}-8.2.3669: multiple vulnerabilities (CVE-2021-{3968,3973,3974})

Summary: <app-editors/{vim,gvim,vim-core}-8.2.3669: multiple vulnerabilities (CVE-2021...

Status:	IN_PROGRESS

Alias:	CVE-2021-3968, CVE-2021-3973, CVE-2021-3974, CVE-2021-3984, CVE-2021-4019

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:
Whiteboard:	B3 [stable]
Keywords:	PullRequest

Depends on:	CVE-2021-4069
Blocks:
	Show dependency tree

Reported:	2021-11-19 13:53 UTC by Sam James
Modified:	2021-12-17 06:42 UTC (History)
CC List:	2 users (show)

See Also:	https://github.com/gentoo/gentoo/pull/23212
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Sam James archtester

2021-11-19 13:53:20 UTC

CVE-2021-3968 (https://huntr.dev/bounties/00d62924-a7b4-4a61-ba29-acab2eaa1528):

vim is vulnerable to Heap-based Buffer Overflow

CVE-2021-3973 (https://github.com/vim/vim/commit/615ddd5342b50a6878a907062aa471740bd9a847):

vim is vulnerable to Heap-based Buffer Overflow

CVE-2021-3974 (https://github.com/vim/vim/commit/64066b9acd9f8cffdf4840f797748f938a13f2d6):

vim is vulnerable to Use After Free

Comment 1 John Helmert III archtester

2021-12-01 16:38:44 UTC

CVE-2021-3984 (https://github.com/vim/vim/commit/2de9b7c7c8791da8853a9a7ca9c467867465b655):

vim is vulnerable to Heap-based Buffer Overflow

CVE-2021-4019 (https://github.com/vim/vim/commit/bd228fd097b41a798f90944b5d1245eddd484142):

vim is vulnerable to Heap-based Buffer Overflow

Need bump to >=8.2.3669

Comment 2 Larry the Git Cow gentoo-dev

2021-12-08 06:21:22 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=520d2400781dbb0bbef1fafd8bed7ab2d5013175

commit 520d2400781dbb0bbef1fafd8bed7ab2d5013175
Author:     Ke Wu <mikewu@google.com>
AuthorDate: 2021-12-07 19:21:48 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2021-12-08 06:20:44 +0000

    app-editors/gvim: version bump to v8.2.3669.
    
    This fixes CVE-2021-3968, CVE-2021-3973, CVE-2021-3974,
    CVE-2021-3984 and CVE-2021-4019.
    
    Bug: https://bugs.gentoo.org/824930
    
    Signed-off-by: Ke Wu <mikewu@google.com>
    Closes: https://github.com/gentoo/gentoo/pull/23212
    Signed-off-by: Sam James <sam@gentoo.org>

 app-editors/gvim/Manifest             |   1 +
 app-editors/gvim/gvim-8.2.3669.ebuild | 383 ++++++++++++++++++++++++++++++++++
 2 files changed, 384 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=952ead41b609e6ab010b6d8edae9724b63034595

commit 952ead41b609e6ab010b6d8edae9724b63034595
Author:     Ke Wu <mikewu@google.com>
AuthorDate: 2021-12-07 19:18:15 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2021-12-08 06:20:43 +0000

    app-editors/vim-core: version bump to v8.2.3669.
    
    This fixes CVE-2021-3968, CVE-2021-3973, CVE-2021-3974,
    CVE-2021-3984 and CVE-2021-4019.
    
    Bug: https://bugs.gentoo.org/824930
    
    Signed-off-by: Ke Wu <mikewu@google.com>
    Signed-off-by: Sam James <sam@gentoo.org>

 app-editors/vim-core/Manifest                 |   1 +
 app-editors/vim-core/vim-core-8.2.3669.ebuild | 233 ++++++++++++++++++++++++++
 2 files changed, 234 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=be6f91c94f38123523623a6d98a67b13377dc07d

commit be6f91c94f38123523623a6d98a67b13377dc07d
Author:     Ke Wu <mikewu@google.com>
AuthorDate: 2021-12-07 19:13:56 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2021-12-08 06:20:42 +0000

    app-editors/vim: version bump to v8.2.3669.
    
    This fixes CVE-2021-3968, CVE-2021-3973, CVE-2021-3974,
    CVE-2021-3984 and CVE-2021-4019.
    
    Bug: https://bugs.gentoo.org/824930
    
    Signed-off-by: Ke Wu <mikewu@google.com>
    Signed-off-by: Sam James <sam@gentoo.org>

 app-editors/vim/Manifest            |   1 +
 app-editors/vim/vim-8.2.3669.ebuild | 355 ++++++++++++++++++++++++++++++++++++
 2 files changed, 356 insertions(+)