CVE-2022-1160: 
NixOS vulnerability analysis and mitigation

A heap buffer overflow vulnerability (CVE-2022-1160) was discovered in the getonesourceline function in the Vim text editor versions prior to 8.2.4647. The vulnerability was introduced in version 8.2.4603 and was fixed in version 8.2.4647 (NVD, Debian Tracker).

The vulnerability occurs in the getonesourceline function within the scriptfile.c file when the 'source' command can read past the end of a copied line. The issue was fixed by adding a terminating NUL character to prevent buffer overflow. The vulnerability has a CVSS v3.1 Base Score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Ubuntu, GitHub Commit).

If successfully exploited, this vulnerability could lead to high impacts on confidentiality, integrity, and availability of the affected system. The heap buffer overflow could potentially allow an attacker to execute arbitrary code or cause a denial of service condition (Ubuntu).

Users should upgrade to Vim version 8.2.4647 or later which contains the fix for this vulnerability. The fix was implemented by adding a terminating NUL character to prevent buffer overflow (GitHub Commit, Fedora Update).