Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 823473 (CVE-2021-3927, CVE-2021-3928) - <app-editors/vim-8.2.3582 <app-editors/gvim-8.2.3582 <app-editors/vim-core-8.2.3582: Multiple vulnerabilities (CVE-2021-{3927,3928})
Summary: <app-editors/vim-8.2.3582 <app-editors/gvim-8.2.3582 <app-editors/vim-core-8....
Status: RESOLVED FIXED
Alias: CVE-2021-3927, CVE-2021-3928
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [glsa+]
Keywords:
Depends on: CVE-2021-3770, CVE-2021-3778, CVE-2021-3796 820698
Blocks:
  Show dependency tree
 
Reported: 2021-11-13 03:07 UTC by Sam James
Modified: 2022-08-21 02:16 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-11-13 03:07:01 UTC
CVE-2021-3927 (https://huntr.dev/bounties/9c2b2c82-48bb-4be9-ab8f-a48ea252d1b0):

vim is vulnerable to Heap-based Buffer Overflow

CVE-2021-3928 (https://huntr.dev/bounties/29c3ebd2-d601-481c-bf96-76975369d0cd):

vim is vulnerable to Stack-based Buffer Overflow
Comment 1 Larry the Git Cow gentoo-dev 2021-11-13 03:09:42 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=22c80816b550543e1eb073749c320717185ad996

commit 22c80816b550543e1eb073749c320717185ad996
Author:     Vaibhav Rustagi <vaibhavrustagi@google.com>
AuthorDate: 2021-11-13 02:01:18 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2021-11-13 03:09:34 +0000

    app-editors/gvim: version bump to v8.2.3582.
    
    This is needed to resolve CVE-2021-3928 and CVE-2021-3927.
    
    Bug: https://bugs.gentoo.org/823473
    Signed-off-by: Vaibhav Rustagi <vaibhavrustagi@google.com>
    Closes: https://github.com/gentoo/gentoo/pull/22924
    Signed-off-by: Sam James <sam@gentoo.org>

 app-editors/gvim/Manifest             |   1 +
 app-editors/gvim/gvim-8.2.3582.ebuild | 383 ++++++++++++++++++++++++++++++++++
 2 files changed, 384 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a98e0fefcf7b04af945bfc2f745a6c03868e8f26

commit a98e0fefcf7b04af945bfc2f745a6c03868e8f26
Author:     Vaibhav Rustagi <vaibhavrustagi@google.com>
AuthorDate: 2021-11-13 01:59:41 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2021-11-13 03:09:33 +0000

    app-editors/vim-core: version bump to v8.2.3582.
    
    This is needed to resolve CVE-2021-3928 and CVE-2021-3927.
    
    Bug: https://bugs.gentoo.org/823473
    Signed-off-by: Vaibhav Rustagi <vaibhavrustagi@google.com>
    Signed-off-by: Sam James <sam@gentoo.org>

 app-editors/vim-core/Manifest                 |   1 +
 app-editors/vim-core/vim-core-8.2.3582.ebuild | 227 ++++++++++++++++++++++++++
 2 files changed, 228 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3b28a3c967b258254ffcbd0ef2a0ac28ed6ee574

commit 3b28a3c967b258254ffcbd0ef2a0ac28ed6ee574
Author:     Vaibhav Rustagi <vaibhavrustagi@google.com>
AuthorDate: 2021-11-13 01:57:45 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2021-11-13 03:09:32 +0000

    app-editors/vim: version bump to v8.2.3582.
    
    This is needed to resolve CVE-2021-3928 and CVE-2021-3927.
    
    Bug: https://bugs.gentoo.org/823473
    Signed-off-by: Vaibhav Rustagi <vaibhavrustagi@google.com>
    Signed-off-by: Sam James <sam@gentoo.org>

 app-editors/vim/Manifest            |   1 +
 app-editors/vim/vim-8.2.3582.ebuild | 349 ++++++++++++++++++++++++++++++++++++
 2 files changed, 350 insertions(+)
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-08-14 05:31:55 UTC
GLSA request filed
Comment 3 Larry the Git Cow gentoo-dev 2022-08-21 02:09:32 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=2cee523fe648754bae0e4ed2a531da672ac5fa15

commit 2cee523fe648754bae0e4ed2a531da672ac5fa15
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2022-08-21 01:33:31 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2022-08-21 01:40:46 +0000

    [ GLSA 202208-32 ] Vim, gVim: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/811870
    Bug: https://bugs.gentoo.org/818562
    Bug: https://bugs.gentoo.org/819528
    Bug: https://bugs.gentoo.org/823473
    Bug: https://bugs.gentoo.org/824930
    Bug: https://bugs.gentoo.org/828583
    Bug: https://bugs.gentoo.org/829658
    Bug: https://bugs.gentoo.org/830106
    Bug: https://bugs.gentoo.org/830994
    Bug: https://bugs.gentoo.org/833572
    Bug: https://bugs.gentoo.org/836432
    Bug: https://bugs.gentoo.org/851231
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 glsa-202208-32.xml | 168 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 168 insertions(+)
Comment 4 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-08-21 02:16:13 UTC
GLSA released, all done!