Detections
Analytics
EulerOS 2.0 SP10 : vim (EulerOS-SA-2025-1542)
low Nessus Plugin ID 235743
Synopsis
The remote EulerOS host is missing multiple security updates.Description
According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try to access a position if the position is greater than the corresponding buffer line. Impact is medium since the user must have switched on visual mode when executing the :all ex command. The Vim project would like to thank github user gandalf4a for reporting this issue.(CVE-2025-22134)
Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode.
However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen).(CVE-2025-24014)
A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component.(CVE-2025-1215)
Tenable has extracted the preceding description block directly from the EulerOS vim security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected vim packages.See Also
Plugin Details
Severity: Low
ID: 235743
File Name: EulerOS_SA-2025-1542.nasl
Version: 1.1
Type: local
Family: Huawei Local Security Checks
Published: 5/12/2025
Updated: 5/12/2025
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.2
CVSS v2
Risk Factor: Low
Base Score: 1.7
Temporal Score: 1.3
Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:P
CVSS Score Source: CVE-2025-1215
CVSS v3
Risk Factor: Medium
Base Score: 4.2
Temporal Score: 3.7
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS Score Source: CVE-2025-24014
CVSS v4
Risk Factor: Low
Base Score: 2.4
Threat Score: 0.4
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Vulnerability Information
CPE: p-cpe:/a:huawei:euleros:vim-minimal, p-cpe:/a:huawei:euleros:vim-common, p-cpe:/a:huawei:euleros:vim-filesystem, cpe:/o:huawei:euleros:2.0, p-cpe:/a:huawei:euleros:vim-enhanced
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/sp
Excluded KB Items: Host/EulerOS/uvp_version
Exploit Ease: No known exploits are available
Patch Publication Date: 5/12/2025
Vulnerability Publication Date: 1/13/2025