CVE-2022-1160

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

heap buffer overflow in get_one_sourceline in GitHub repository vim/vim prior to 8.2.4647.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-787

Affected software

Vendor	Product	Versions
vim	vim/vim	>= unspecified, < 8.2.4647

References

https://github.com/vim/vim/commit/2bdad6126778f907c0b98002bfebf0e611a3f5dbPatch, Third Party Advisory
https://huntr.dev/bounties/a6f3222d-2472-439d-8881-111138a5694cExploit, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C2CQXRLBIC4S7JQVEIN5QXKQPYWB5E3J/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAIQTUO35U5WO2NYMY47637EMCVDJRSL/
https://security.gentoo.org/glsa/202208-32Third Party Advisory
https://security.gentoo.org/glsa/202305-16
https://github.com/vim/vim/commit/2bdad6126778f907c0b98002bfebf0e611a3f5dbPatch, Third Party Advisory
https://huntr.dev/bounties/a6f3222d-2472-439d-8881-111138a5694cExploit, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C2CQXRLBIC4S7JQVEIN5QXKQPYWB5E3J/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAIQTUO35U5WO2NYMY47637EMCVDJRSL/
https://security.gentoo.org/glsa/202208-32Third Party Advisory
https://security.gentoo.org/glsa/202305-16

Timeline

Published: Mar 30, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-11619.8An attacker with the ability to modify a user program may change user program code on some ControlLogix, CompactLogix, and GuardLogix Contro CVE-2022-11629.8A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior CVE-2022-11634.8Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next.CVE-2022-11646.1The Wyzi Theme was affected by reflected XSS vulnerabilities in the business search feature CVE-2022-11659.1The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determine the IP address of CVE-2022-11665.3The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP CVE-2022-11676.1There are unauthenticated reflected Cross-Site Scripting (XSS) vulnerabilities in CareerUp Careerup WordPress theme before 2.3.1, via the fi CVE-2022-11686.1There is a Cross-Site Scripting vulnerability in the JobSearch WP JobSearch WordPress plugin before 1.5.1.CVE-2022-11696.1There is a XSS vulnerability in Careerfy.CVE-2022-11706.1In the Noo JobMonster WordPress theme before 4.5.2.9 JobMonster there is a XSS vulnerability as the input for the search form is provided th CVE-2022-11716.1The Vertical scroll recent post WordPress plugin before 14.0 does not sanitise and escape a parameter before outputting it back in an attrib CVE-2022-11725.0Null Pointer Dereference Caused Segmentation Fault in GitHub repository gpac/gpac prior to 2.1.0-DEV.