CVE-2022-0714: 
NixOS vulnerability analysis and mitigation

A heap-based buffer overflow vulnerability was discovered in GitHub repository vim/vim prior to version 8.2.4436. The vulnerability was assigned CVE-2022-0714 and was disclosed in February 2022. The vulnerability affects the vim text editor across multiple operating systems and distributions (CVE, Ubuntu).

The vulnerability exists in the win_lbr_chartabsize() function when processing certain 'vartabstop' values. The issue occurs when the function fails to properly check for the end of a line, which can lead to a heap-based buffer overflow condition. This was addressed in vim version 8.2.4436 by adding additional bounds checking logic to prevent running past the end of the line (GitHub Commit).

The vulnerability could allow an attacker to cause a denial of service (application crash) or potentially achieve arbitrary code execution through a specially crafted input (Debian, Gentoo).

The vulnerability was fixed in vim version 8.2.4436. Users are advised to upgrade to this version or later. Multiple Linux distributions have released security updates to address this vulnerability, including Ubuntu, Debian, Fedora, and Gentoo (Ubuntu, Debian, Fedora).