The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3204 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3204-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Helmut Grohne     November 24, 2022                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : vim     Version        : 2:8.1.0875-5+deb10u4     CVE ID         : CVE-2022-0318 CVE-2022-0392 CVE-2022-0629 CVE-2022-0696                      CVE-2022-1619 CVE-2022-1621 CVE-2022-1785 CVE-2022-1897                      CVE-2022-1942 CVE-2022-2000 CVE-2022-2129 CVE-2022-3235                      CVE-2022-3256 CVE-2022-3352

    This update fixes multiple memory access violations in vim.

    CVE-2022-0318

        Heap-based Buffer Overflow

    CVE-2022-0392

        Heap-based Buffer Overflow

    CVE-2022-0629

        Stack-based Buffer Overflow

    CVE-2022-0696

        NULL Pointer Dereference

    CVE-2022-1619

        Heap-based Buffer Overflow in function cmdline_erase_chars.  This         vulnerabilities are capable of crashing software, modify memory, and         possible remote execution

    CVE-2022-1621

        Heap buffer overflow in vim_strncpy find_word. This vulnerability is         capable of crashing software, Bypass Protection Mechanism, Modify         Memory, and possible remote execution

    CVE-2022-1785

        Out-of-bounds Write

    CVE-2022-1897

        Out-of-bounds Write

    CVE-2022-1942

        Heap-based Buffer Overflow

    CVE-2022-2000

        Out-of-bounds Write

    CVE-2022-2129

        Out-of-bounds Write

    CVE-2022-3235

        Use After Free

    CVE-2022-3256

        Use After Free

    CVE-2022-3352

        Use After Free

    For Debian 10 buster, these problems have been fixed in version     2:8.1.0875-5+deb10u4.

    We recommend that you upgrade your vim packages.

    For the detailed security status of vim please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/vim

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3204 : vim - security update

critical Nessus Plugin ID 168183

Version 1.4

Version 1.3

Version 1.2

Version 1.4 Jan 22, 2025, 5:44 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202501221744
Version 1.3 Sep 20, 2023, 4:09 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202309201609
Version 1.2 Nov 25, 2022, 10:12 AM New Plugin Feed: 202211251012