critical
CVE-2022-0318
vim: Heap-based buffer overflow in utf_head_off() in mbyte.c
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat6.6CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, CBL-Mariner, Photon OS. Rated lower by Amazon (high), Red Hat (medium), AlmaLinux (medium), Oracle (medium), Rocky Linux (medium), Ubuntu (medium).
Description
Heap-based Buffer Overflow in vim/vim prior to 8.2.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| CBL-Mariner 1.0 | vim | 0:8.2.4151-1.cm1 |
| CBL-Mariner 2.0 | vim | 0:8.2.4233-1.cm2 |
| Photon OS 2.0 | vim | 8.0.0533-17.ph2 |
| Photon OS 3.0 | vim | 8.2.3408-15.ph3 |
| Photon OS 4.0 | vim, vim-extra | 8.2.3428-7.ph4 |
| alma 8 | vim-X11, vim-common, vim-enhanced and 2 more | 2:8.0.1763-16.el8_5.12 and 1 more |
| amazon linux 1 | vim-common, vim-data, vim-debuginfo and 3 more | 2:8.2.4877-1.1.amzn1 |
| amazon linux 2 | vim-X11, vim-common, vim-data and 4 more | 2:8.2.4314-1.amzn2.0.1 |
| amazon linux 2022 | vim-X11, vim-X11-debuginfo, vim-common and 10 more | 2:8.2.4198-1.amzn2022 and 1 more |
| amazon linux 2023 | vim-common, vim-common-debuginfo, vim-data and 8 more | 2:9.0.1160-1.amzn2023.0.2 |
| debian 10 | vim | 2:8.1.0875-5+deb10u4 |
| debian 11 | vim | no fix listed |
Show all 74 entries from 29 sources
| Source | Package | Fixed in |
|---|---|---|
| CBL-Mariner 1.0 | vim | 0:8.2.4151-1.cm1 |
| CBL-Mariner 2.0 | vim | 0:8.2.4233-1.cm2 |
| Photon OS 2.0 | vim | 8.0.0533-17.ph2 |
| Photon OS 3.0 | vim | 8.2.3408-15.ph3 |
| Photon OS 4.0 | vim | 8.2.3428-7.ph4 |
| Photon OS 4.0 | vim-extra | 8.2.3428-7.ph4 |
| alma 8 | vim-X11 | 2:8.0.1763-16.el8_5.12 |
| alma 8 | vim-common | 2:8.0.1763-16.el8_5.12 |
| alma 8 | vim-enhanced | 2:8.0.1763-16.el8_5.12 |
| alma 8 | vim-filesystem | 2:8.0.1763-16.el8_5.12 |
| alma 8 | vim-minimal | 2:8.0.1763-16.el8_5.13 |
| amazon linux 1 | vim-common | 2:8.2.4877-1.1.amzn1 |
| amazon linux 1 | vim-data | 2:8.2.4877-1.1.amzn1 |
| amazon linux 1 | vim-debuginfo | 2:8.2.4877-1.1.amzn1 |
| amazon linux 1 | vim-enhanced | 2:8.2.4877-1.1.amzn1 |
| amazon linux 1 | vim-filesystem | 2:8.2.4877-1.1.amzn1 |
| amazon linux 1 | vim-minimal | 2:8.2.4877-1.1.amzn1 |
| amazon linux 2 | vim-X11 | 2:8.2.4314-1.amzn2.0.1 |
| amazon linux 2 | vim-common | 2:8.2.4314-1.amzn2.0.1 |
| amazon linux 2 | vim-data | 2:8.2.4314-1.amzn2.0.1 |
| amazon linux 2 | vim-debuginfo | 2:8.2.4314-1.amzn2.0.1 |
| amazon linux 2 | vim-enhanced | 2:8.2.4314-1.amzn2.0.1 |
| amazon linux 2 | vim-filesystem | 2:8.2.4314-1.amzn2.0.1 |
| amazon linux 2 | vim-minimal | 2:8.2.4314-1.amzn2.0.1 |
| amazon linux 2022 | vim-X11 | 2:8.2.4198-1.amzn2022 |
| amazon linux 2022 | vim-X11-debuginfo | 2:8.2.4198-1.amzn2022 |
| amazon linux 2022 | vim-common | 2:9.0.475-1.amzn2022.0.1 |
| amazon linux 2022 | vim-common-debuginfo | 2:9.0.475-1.amzn2022.0.1 |
| amazon linux 2022 | vim-data | 2:9.0.475-1.amzn2022.0.1 |
| amazon linux 2022 | vim-debuginfo | 2:9.0.475-1.amzn2022.0.1 |
| amazon linux 2022 | vim-debugsource | 2:9.0.475-1.amzn2022.0.1 |
| amazon linux 2022 | vim-default-editor | 2:9.0.475-1.amzn2022.0.1 |
| amazon linux 2022 | vim-enhanced | 2:9.0.475-1.amzn2022.0.1 |
| amazon linux 2022 | vim-enhanced-debuginfo | 2:9.0.475-1.amzn2022.0.1 |
| amazon linux 2022 | vim-filesystem | 2:9.0.475-1.amzn2022.0.1 |
| amazon linux 2022 | vim-minimal | 2:9.0.475-1.amzn2022.0.1 |
| amazon linux 2022 | vim-minimal-debuginfo | 2:9.0.475-1.amzn2022.0.1 |
| amazon linux 2023 | vim-common | 2:9.0.1160-1.amzn2023.0.2 |
| amazon linux 2023 | vim-common-debuginfo | 2:9.0.1160-1.amzn2023.0.2 |
| amazon linux 2023 | vim-data | 2:9.0.1160-1.amzn2023.0.2 |
| amazon linux 2023 | vim-debuginfo | 2:9.0.1160-1.amzn2023.0.2 |
| amazon linux 2023 | vim-debugsource | 2:9.0.1160-1.amzn2023.0.2 |
| amazon linux 2023 | vim-default-editor | 2:9.0.1160-1.amzn2023.0.2 |
| amazon linux 2023 | vim-enhanced | 2:9.0.1160-1.amzn2023.0.2 |
| amazon linux 2023 | vim-enhanced-debuginfo | 2:9.0.1160-1.amzn2023.0.2 |
| amazon linux 2023 | vim-filesystem | 2:9.0.1160-1.amzn2023.0.2 |
| amazon linux 2023 | vim-minimal | 2:9.0.1160-1.amzn2023.0.2 |
| amazon linux 2023 | vim-minimal-debuginfo | 2:9.0.1160-1.amzn2023.0.2 |
| debian 10 | vim | 2:8.1.0875-5+deb10u4 |
| debian 11 | vim | no fix listed |
| debian 12 | vim | 2:8.2.4659-1 |
| debian 13 | vim | 2:8.2.4659-1 |
| debian 14 | vim | 2:8.2.4659-1 |
| debian 9 | vim | no fix listed |
| echo | vim | 2:8.2.4659-1 |
| Oracle Linux 8 | vim-X11 | 2:8.0.1763-16.0.1.el8_5.12 |
| Oracle Linux 8 | vim-common | 2:8.0.1763-16.0.1.el8_5.12 |
| Oracle Linux 8 | vim-enhanced | 2:8.0.1763-16.0.1.el8_5.12 |
| Oracle Linux 8 | vim-filesystem | 2:8.0.1763-16.0.1.el8_5.12 |
| Oracle Linux 8 | vim-minimal | 2:8.0.1763-16.0.1.el8_5.12 |
| rapidfort ubuntu 20.04 | rf-vim | 2:8.2.3995-1ubuntu2.7 |
| rapidfort ubuntu 20.04 | vim | 2:8.2.3995-1ubuntu2.7 |
| rapidfort ubuntu 22.04 | rf-vim | 2:8.2.3995-1ubuntu2.7 |
| rapidfort ubuntu 22.04 | vim | 2:8.2.3995-1ubuntu2.7 |
| rapidfort ubuntu 24.04 | rf-vim | 2:8.2.3995-1ubuntu2.7 |
| rapidfort ubuntu 24.04 | vim | 2:8.2.3995-1ubuntu2.7 |
| rocky 8 | vim-minimal | 2:8.0.1763-16.el8_5.12 |
| root.io debian 12 | rootio-vim | 2:8.2.4659-1 |
| ubuntu 16.04-ESM | vim | 2:7.4.1689-3ubuntu1.5+esm4 |
| ubuntu 18.04 | vim | 2:8.0.1453-1ubuntu1.13 |
| ubuntu 18.04-ESM | vim | 2:8.0.1453-1ubuntu1.13 |
| ubuntu 20.04 | vim | 2:8.1.2269-1ubuntu5.14 |
| ubuntu 20.04-ESM | vim | 2:8.1.2269-1ubuntu5.14 |
| ubuntu 22.04 | vim | 2:8.2.3995-1ubuntu2.7 |
References
- http://seclists.org/fulldisclosure/2022/Oct/28
- http://seclists.org/fulldisclosure/2022/Oct/41
- http://seclists.org/fulldisclosure/2022/Oct/43
- https://access.redhat.com/errata/RHSA-2022:0894
- https://access.redhat.com/security/cve/CVE-2022-0318
- https://bugzilla.redhat.com/show_bug.cgi?id=2044607
- https://bugzilla.redhat.com/show_bug.cgi?id=2045355
- https://bugzilla.redhat.com/show_bug.cgi?id=2046479
All 33 references
- https://bugzilla.redhat.com/show_bug.cgi?id=2048519
- https://bugzilla.redhat.com/show_bug.cgi?id=2049175
- https://bugzilla.redhat.com/show_bug.cgi?id=2050053
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0261
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0318
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0359
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0361
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0392
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0413
- https://errata.almalinux.org/8/ALSA-2022-0894.html
- https://errata.rockylinux.org/RLSA-2022:0894
- https://github.com/vim/vim/commit/57df9e8a9f9ae1aafdde9b86b10ad907627a87dc
- https://huntr.dev/bounties/0d10ba02-b138-4e68-a284-67f781a62d08
- https://linux.oracle.com/cve/CVE-2022-0318.html
- https://linux.oracle.com/errata/ELSA-2022-0894.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-0318
- https://security.gentoo.org/glsa/202208-32
- https://security.netapp.com/advisory/ntap-20241115-0004/
- https://support.apple.com/kb/HT213444
- https://support.apple.com/kb/HT213488
- https://ubuntu.com/security/notices/USN-5433-1
- https://ubuntu.com/security/notices/USN-6026-1
- https://www.cve.org/CVERecord?id=CVE-2022-0318