Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command.
[ { "source": "https://github.com/vim/vim/commit/cc762a48d42b579fb7bdec2c614636b830342dd5", "deprecated": false, "digest": { "function_hash": "190665615910924140193533824665858128785", "length": 132.0 }, "target": { "file": "src/normal.c", "function": "check_text_locked" }, "id": "CVE-2022-4141-0b71d2a5", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://github.com/vim/vim/commit/cc762a48d42b579fb7bdec2c614636b830342dd5", "deprecated": false, "digest": { "line_hashes": [ "146200493773228420153804765641940418619", "19107704351937658916396991932579026420", "84943070858833316092341833756629264000", "208238244323940946111456887309707359065" ], "threshold": 0.9 }, "target": { "file": "src/version.c" }, "id": "CVE-2022-4141-11370665", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://github.com/vim/vim/commit/cc762a48d42b579fb7bdec2c614636b830342dd5", "deprecated": false, "digest": { "function_hash": "148372584920342045947904113320687934815", "length": 7433.0 }, "target": { "file": "src/window.c", "function": "do_window" }, "id": "CVE-2022-4141-1bcae1ca", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://github.com/vim/vim/commit/cc762a48d42b579fb7bdec2c614636b830342dd5", "deprecated": false, "digest": { "function_hash": "41927408926098337937290331865084526008", "length": 5569.0 }, "target": { "file": "src/normal.c", "function": "normal_cmd" }, "id": "CVE-2022-4141-45b41d77", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://github.com/vim/vim/commit/cc762a48d42b579fb7bdec2c614636b830342dd5", "deprecated": false, "digest": { "line_hashes": [ "111105251772351747393828123747003534483", "316114873586263889081896200225949289872", "149404304939167195564793133082021260723", "262239380249590148619516378693893467096", "239760366503954371451524539451863226094", "119258988697698457769296765622298402469", "206915417328863978063702214454213884339", "158745081761057373172193164568155585443", "268583924997973245978123153239103417679", "333922411034167128884482823274065159137", "276710804345213625079684015864446123024", "336893809268346007791123208812180745396", "243945707329960535404068639116829227460", "81531767778345427670047092357775368603", "239882497922201721117182794677871657601", "186691752488174874618452415496572726853", "13925699631788370508684966330277730974", "173458226200216082160727634638432155178", "18783741097182704807210020097538433003", "209235129588614593617175264075500676816", "197406996245591940943858599037703424162", "44667055706627394761234254644268698522", "242837119946815505318126626808939922498", "282568395604460771791443673667236413242" ], "threshold": 0.9 }, "target": { "file": "src/normal.c" }, "id": "CVE-2022-4141-9c9ffb42", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://github.com/vim/vim/commit/cc762a48d42b579fb7bdec2c614636b830342dd5", "deprecated": false, "digest": { "function_hash": "204052534016682010466162385405474432641", "length": 729.0 }, "target": { "file": "src/normal.c", "function": "nv_gotofile" }, "id": "CVE-2022-4141-eb55c41b", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://github.com/vim/vim/commit/cc762a48d42b579fb7bdec2c614636b830342dd5", "deprecated": false, "digest": { "line_hashes": [ "215973605316463389639257437332826783750", "42011348008941328784860549530110234751", "288397763471386272834289695701266412526", "336875427931983799284492521363086320241", "213447987474801374640585758454865282615", "111849600522103543090032272586242935850", "83251671520865874399261131550009543604" ], "threshold": 0.9 }, "target": { "file": "src/window.c" }, "id": "CVE-2022-4141-f65049f6", "signature_type": "Line", "signature_version": "v1" } ]