Anmelden API-Schlüssel holen

6.8Mittel

CVE-2021-4187Use After Free in vim/vim

vim vim/vim Veröffentlicht: 2021-12-29 20:10 (vor 4 Jahren)

Beschreibung

vim is vulnerable to Use After Free

Schwachstellentyp (CWE): CWE-416

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
apple	mac os x	10.15.7
apple	macos	< 12.3
fedoraproject	fedora	34
vim	vim	≤ 8.2.3912
vim	vim/vim	unspecified – < 8.2

Referenzen und Patches

https://huntr.dev/bounties/a8bee03a-6e2e-43bf-bee3-4968c5386a2e ExploitThird Party Advisory
https://github.com/vim/vim/commit/4bf1006cae7e87259ccd5219128c3dba75774441 PatchThird Party Advisory
FEDORA-2022-a3d70b50f0 vendor-advisory
[oss-security] 20220114 Re: 3 new CVE's in vim mailing-listMailing ListThird Party Advisory
FEDORA-2022-48b86d586f vendor-advisory
https://support.apple.com/kb/HT213183 Release NotesThird Party Advisory
20220314 APPLE-SA-2022-03-14-4 macOS Monterey 12.3 mailing-listMailing ListThird Party Advisory
https://support.apple.com/kb/HT213256 Third Party Advisory
20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6 mailing-listMailing ListThird Party Advisory
https://support.apple.com/kb/HT213343 Third Party Advisory
20220721 APPLE-SA-2022-07-20-4 Security Update 2022-005 Catalina mailing-listMailing ListThird Party Advisory
GLSA-202208-32 vendor-advisoryThird Party Advisory
https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html

CPE-Treffer (NVD) (19)

cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* ≤ 8.2.3912
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-002:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-003:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-004:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-005:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-006:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-007:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-008:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-001:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-002:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-003:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* < 12.3
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* ≥ 11.0 < 11.6.6
cpe:2.3:o:apple:macos:10.15.7:security_update_2022-004:*:*:*:*:*:*

CVSS-Score

6.8Mittel

Quelle: @huntrdev · CVSS 3.0

Angriffsvektor: Lokal
Komplexität: Niedrig
Rechte erforderlich: Niedrig
Benutzerinteraktion: Erforderlich
Geltungsbereich: Unverändert
Vertraulichkeit: Niedrig
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H

Alle Scores (4)

cna	CVSS 3.0	6.8Mittel
nvd	CVSS 3.1	7.8Hoch
security@huntr.dev	CVSS 3.0	6.8Mittel
nvd	CVSS 2.0	6.8Mittel

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

1.76%

höher als 78 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: no
Technische Auswirkung: partial

Zeitverlauf

ID reserviert2021-12-28
Veröffentlicht2021-12-29 20:10
Bei IP-DB eingegangen2026-11-02 22:03
Zuletzt aktualisiert2026-11-02 22:17

Vergeben von (CNA): @huntrdev
NVD-Status: Modified

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Apple macOS

8.8Hoch

CVE-2026-113970 gestern

Apple iOS and iPadOS; Apple macOS; Apple visionOS; Apple watchOS

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, vision…

5.4Mittel

CVE-2026-113964 gestern

Apple iOS and iPadOS; Apple macOS; Apple visionOS; Apple watchOS

A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1,…

5.4Mittel

CVE-2026-113965 gestern

Apple iOS and iPadOS; Apple macOS; Apple visionOS; Apple watchOS

This issue was addressed with improved checks. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6…

5.4Mittel

CVE-2026-113968 gestern

Apple iOS and iPadOS; Apple macOS; Apple visionOS; Apple watchOS

A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1,…

Ohne Score

CVE-2026-113969 gestern

Apple iOS and iPadOS; Apple macOS; Apple visionOS; Apple watchOS

A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1,…

Ohne Score

CVE-2026-113960 gestern

Apple iOS and iPadOS; Apple macOS; Apple visionOS; Apple watchOS

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A user added to a…