Entrar Obtener clave API

6.8Media

CVE-2021-4173Use After Free in vim/vim

vim vim/vim Publicada: 2021-12-27 15:25 (hace 4 años)

Descripción

vim is vulnerable to Use After Free

Debilidad (CWE): CWE-416

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
apple	mac os x	10.15.7
apple	macos	< 12.3
fedoraproject	fedora	34
vim	vim	< 8.2.3902
vim	vim/vim	unspecified – < 8.2

Referencias y parches

https://huntr.dev/bounties/a1b236b9-89fb-4ccf-9689-ba11b471e766 ExploitThird Party Advisory
https://github.com/vim/vim/commit/9c23f9bb5fe435b28245ba8ac65aa0ca6b902c04 PatchThird Party Advisory
FEDORA-2022-a3d70b50f0 vendor-advisory
[oss-security] 20220114 Re: 3 new CVE's in vim mailing-listMailing ListThird Party Advisory
FEDORA-2022-48b86d586f vendor-advisory
https://support.apple.com/kb/HT213183 Release NotesThird Party Advisory
20220314 APPLE-SA-2022-03-14-4 macOS Monterey 12.3 mailing-listMailing ListThird Party Advisory
https://support.apple.com/kb/HT213256 Third Party Advisory
20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6 mailing-listMailing ListThird Party Advisory
https://support.apple.com/kb/HT213343 Third Party Advisory
20220721 APPLE-SA-2022-07-20-4 Security Update 2022-005 Catalina mailing-listMailing ListThird Party Advisory
GLSA-202208-32 vendor-advisoryThird Party Advisory
https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html

Coincidencias CPE (NVD) (19)

cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:* < 8.2.3902
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-002:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-003:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-004:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-005:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-006:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-007:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-008:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-001:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-002:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2022-003:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* < 12.3
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* ≥ 11.0 < 11.6.6
cpe:2.3:o:apple:macos:10.15.7:security_update_2022-004:*:*:*:*:*:*

Puntuación CVSS

6.8Media

Fuente: @huntrdev · CVSS 3.0

Vector de ataque: Local
Complejidad: Baja
Privilegios: Bajos
Interacción del usuario: Requerida
Alcance: Sin cambio
Confidencialidad: Bajo
Integridad: Alto
Disponibilidad: Alto

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H

Todas las puntuaciones (4)

cna	CVSS 3.0	6.8Media
nvd	CVSS 3.1	7.8Alta
security@huntr.dev	CVSS 3.0	6.8Media
nvd	CVSS 2.0	6.8Media

EPSS (probabilidad de explotación en 30 días)

1.76%

superior al 78 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: no
Impacto técnico: partial

Cronología

ID reservado2021-12-26
Publicada2021-12-27 15:25
Llegó a IP-DB2026-11-02 22:03
Última actualización2026-11-02 22:17

Asignada por (CNA): @huntrdev
Estado en NVD: Modified

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — Apple macOS

8.8Alta

CVE-2026-113970 ayer

Apple iOS and iPadOS; Apple macOS; Apple visionOS; Apple watchOS

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, vision…

5.4Media

CVE-2026-113964 ayer

Apple iOS and iPadOS; Apple macOS; Apple visionOS; Apple watchOS

A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1,…

5.4Media

CVE-2026-113965 ayer

Apple iOS and iPadOS; Apple macOS; Apple visionOS; Apple watchOS

This issue was addressed with improved checks. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6…

5.4Media

CVE-2026-113968 ayer

Apple iOS and iPadOS; Apple macOS; Apple visionOS; Apple watchOS

A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1,…

Sin puntuación

CVE-2026-113969 ayer

Apple iOS and iPadOS; Apple macOS; Apple visionOS; Apple watchOS

A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1,…

Sin puntuación

CVE-2026-113960 ayer

Apple iOS and iPadOS; Apple macOS; Apple visionOS; Apple watchOS

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A user added to a…