{"id":"CLSA-2026-1787304699","summary":"Fix of 10 CVEs","details":"   * SECURITY UPDATE: stack-based buffer overflow in option callback\n     functions: illegal_char() and did_set_string_option() wrote the\n     E539/E526/E535 option errors into the caller's 80-byte errbuf[] with\n     unbounded sprintf().  The call site reported upstream,\n     did_set_langmap() in src/map.c, does not exist in this version, where\n     'langmap' errors are reported through EMSG2() into a bounded buffer.\n     - debian/patches/CVE-2024-22667.patch: introduce ERR_BUFLEN and use\n       snprintf() bounded by it at the three sprintf() sites, in\n       src/option.c and src/option.h; matches upstream patch 9.0.2142.\n     - CVE-2024-22667\n   * SECURITY UPDATE: buffer overflow in 'helpfile' option handling:\n     get_tagfname() copied the user-controlled 'helpfile' value into a\n     MAXPATHL buffer with STRCPY() and then appended \"tags\" at the tail, so\n     an over-long 'helpfile' overflowed the buffer.\n     - debian/patches/CVE-2026-25749.patch: bound the copy with\n       vim_strncpy() leaving room for the \"tags\" suffix, in src/tag.c;\n       matches upstream patches 9.1.2132 and 9.1.2133.\n     - CVE-2026-25749\n   * SECURITY UPDATE: buffer overflow in the netbeans specialKeys command:\n     special_keys() walked the modifier prefix writing two bytes per\n     modifier into the 64-byte keybuf[] with no bound, so a long modifier\n     run overflowed it.\n     - debian/patches/CVE-2026-26269.patch: stop the modifier loop while\n       i + 2 \u003c KEYBUFLEN, in src/netbeans.c; matches upstream patch\n       9.1.2148.\n     - CVE-2026-26269\n   * SECURITY UPDATE: command injection via netrw URIs: the hostname and\n     port taken from a netrw URI were interpolated unescaped into the\n     command passed to system(), so shell metacharacters in the host or\n     port ran arbitrary commands.\n     - debian/patches/CVE-2026-28417.patch: validate the host against an\n       RFC1123 hostname / IPv4 / IPv6 pattern at the four netrw entry\n       points and shellescape() the host, user and port in s:MakeSshCmd(),\n       in runtime/autoload/netrw.vim; matches upstream patches 9.2.0073,\n       9.2.0089 and 9.2.0553.\n     - CVE-2026-28417\n   * SECURITY UPDATE: crash and huge allocation recovering a corrupted swap\n     file: ml_recover() trusted pe_page_count, pe_bnum, pe_old_lnum and\n     pe_line_count from the swap file, so bogus values caused a multi-GB\n     mf_get() allocation or a SEGV inside readfile().\n     - debian/patches/CVE-2026-28421.patch: bound pe_page_count and\n       pe_bnum against mf_blocknr_max and validate pe_old_lnum and\n       pe_line_count before use, in src/memline.c; matches upstream patch\n       9.2.0077.\n     - CVE-2026-28421\n   * SECURITY UPDATE: command injection via newline in glob(): the newline\n     character was missing from SHELL_SPECIAL, so it was not escaped before\n     mch_expand_wildcards() handed the pattern to the shell and could act\n     as a command separator.\n     - debian/patches/CVE-2026-33412.patch: add '\\n' to SHELL_SPECIAL, in\n       src/os_unix.c; matches upstream patch 9.2.0202.\n     - CVE-2026-33412\n   * SECURITY UPDATE: modeline security bypass: several options holding\n     expressions could be set from a modeline, so opening a crafted file\n     evaluated attacker-supplied expressions.  In this version the\n     expressions reachable this way are the 'statusline'-style %{} items of\n     'printheader' and 'guitabtooltip', which were evaluated in the sandbox\n     only; the F{func} flag of 'complete' and the mapset() function named by\n     the upstream advisory arrived in later releases and are not present in\n     this version.\n     - debian/patches/patch-8.1.1366-using-expressions-in-a-modeline-is-unsafe.patch:\n       add the 'modelineexpr' option and the P_MLE flag,\n       refuse P_MLE options in a modeline unless 'modelineexpr' is set,\n       mark the expression-bearing options P_MLE, and document\n       'modelineexpr' and E992, in src/option.c, src/option.h and\n       runtime/doc/options.txt; prerequisite for the fix below.\n     - debian/patches/patch-8.1.1367-can-set-modelineexpr-in-modeline.patch:\n       mark 'modelineexpr' itself P_SECURE so a modeline cannot enable it,\n       and document that, in src/option.c and runtime/doc/options.txt;\n       without this the check above can be turned off by the crafted file\n       itself.\n     - debian/patches/CVE-2026-34982.patch: mark 'complete',\n       'guitabtooltip' and 'printheader' P_MLE, in src/option.c; matches\n       upstream patch 9.2.0276.\n     - CVE-2026-34982\n   * SECURITY UPDATE: path traversal in zip.vim: neither zip#Write() nor\n     zip#Extract() rejected archive members whose path escaped the\n     extraction directory, so a crafted zip could write outside it.\n     - debian/patches/CVE-2026-35177.patch: reject any path that simplifies\n       to one containing \"../\" in both zip#Write() and zip#Extract(), in\n       runtime/autoload/zip.vim; matches upstream patch 9.2.0280.\n     - CVE-2026-35177\n   * SECURITY UPDATE: command injection in the netbeans interface via\n     defineAnnoType: typeName, fg and bg arrived unvalidated from the\n     NetBeans server and were interpolated into an Ex command, so a bar\n     could append arbitrary commands; specialKeys likewise built a map\n     command from an unvalidated key token.\n     - debian/patches/CVE-2026-39881.patch: validate typeName, fg and bg\n       against character allowlists and accept only alphanumerics and '-'\n       in a specialKeys token, in src/netbeans.c; matches upstream patch\n       9.2.0316.\n     - CVE-2026-39881\n   * SECURITY UPDATE: command injection via backticks in tag files:\n     expand_tag_fname() passed a tag filename containing backticks to\n     wildcard expansion, which ran it through the shell.\n     - debian/patches/CVE-2026-41411.patch: refuse to expand a tag filename\n       containing a backtick, in src/tag.c; matches upstream patch\n       9.2.0357.\n     - CVE-2026-41411\n   * NOTE: behaviour change that comes with the 'modelineexpr' mechanism\n     above: options that hold an expression ('balloonexpr', 'foldexpr',\n     'foldtext', 'formatexpr', 'guitablabel', 'iconstring', 'includeexpr',\n     'indentexpr', 'rulerformat', 'statusline', 'tabline', 'titlestring',\n     'complete', 'guitabtooltip' and 'printheader') can no longer be set\n     from a modeline unless the new 'modelineexpr' option is on, and are\n     refused with E992.  'cdpath' becomes modeline- and sandbox-refused\n     (E520).  This is the upstream 8.1.1366 behaviour; see\n     :help modelineexpr.\n   * debian/patches/fix-Test_terminal_cwd.patch: join the first two terminal\n     lines before comparing in Test_terminal_cwd(), so the test still passes\n     when the build path is long enough for the pwd output to wrap; matches\n     upstream patch 9.0.0541.","modified":"2026-10-26T09:31:47.599230366Z","published":"2026-08-21T09:31:57Z","upstream":["CVE-2024-22667","CVE-2026-25749","CVE-2026-26269","CVE-2026-28417","CVE-2026-28421","CVE-2026-33412","CVE-2026-34982","CVE-2026-35177","CVE-2026-39881","CVE-2026-41411"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787304699.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22667"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25749"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26269"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28417"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28421"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33412"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34982"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35177"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39881"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41411"}],"affected":[{"package":{"name":"vim","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787304699.json"}},{"package":{"name":"vim-athena","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim-athena?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787304699.json"}},{"package":{"name":"vim-common","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim-common?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787304699.json"}},{"package":{"name":"vim-doc","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim-doc?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787304699.json"}},{"package":{"name":"vim-gnome","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim-gnome?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787304699.json"}},{"package":{"name":"vim-gtk","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim-gtk?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787304699.json"}},{"package":{"name":"vim-gtk3","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim-gtk3?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787304699.json"}},{"package":{"name":"vim-gui-common","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim-gui-common?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787304699.json"}},{"package":{"name":"vim-nox","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim-nox?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787304699.json"}},{"package":{"name":"vim-runtime","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim-runtime?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787304699.json"}},{"package":{"name":"vim-tiny","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim-tiny?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787304699.json"}},{"package":{"name":"xxd","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/xxd?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787304699.json"}}],"schema_version":"1.9.0"}