GHSA-h6c7-9rqq-5r2p

GHSA-h6c7-9rqq-5r2p PUBLISHED CVSS 9.800000190734863 CRITICAL

Record from GitHub Advisory Database · Published May 14, 2022

An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.

Risk scores

CVSS 3.0

9.800000190734863

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

May 14, 2022 CVE Published
Apr 30, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-h6c7-9rqq-5r2p
vulnetix vdb fixes GHSA-h6c7-9rqq-5r2p

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-h6c7-9rqq-5r2p/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

https://nvd.nist.gov/vuln/detail/CVE-2017-6350 advisory
https://groups.google.com/forum/#%21topic/vim_dev/L_dOHOOiQ5Q url
https://usn.ubuntu.com/4309-1 url
https://security.gentoo.org/glsa/201706-26 url
http://www.securitytracker.com/id/1037949 url
https://github.com/vim/vim/commit/0c8485f0e4931463c0f7986e1ea84a7d79f10c75 url
https://groups.google.com/forum/#!topic/vim_dev/L_dOHOOiQ5Q url
https://groups.google.com/forum/#!topic/vim_dev/QPZc0CY9j3Y url
https://groups.google.com/forum/#%21topic/vim_dev/QPZc0CY9j3Y url
http://www.securityfocus.com/bid/96448 url

Look up in the Resolve Platform →