{"id":"CLSA-2026-1787394930","summary":"Fix of 10 CVEs","details":"   * SECURITY UPDATE: command injection in the tar plugin: tar#Vimuntar()\n     escaped the tarball name with shellescape() without the special\n     argument before running gunzip/gzip through :!, so characters that Vim\n     expands in a :! command line (such as % and #) survived in the name\n     and let a crafted archive name run arbitrary shell commands.\n     - debian/patches/CVE-2026-46483.patch: use the shellescape(name, 1)\n       form for both :! invocations in runtime/autoload/tar.vim; matches\n       upstream patch 9.2.0479.\n     - CVE-2026-46483\n   * SECURITY UPDATE: code injection via netrw directory history:\n     s:NetrwBookHistSave() serialised each history entry into\n     ~/.vim/.netrwhist by wrapping the value in single quotes with string\n     concatenation, so a directory name containing a single quote closed\n     the literal and injected Vimscript that ran when the history file was\n     sourced on the next netrw start.\n     - debian/patches/CVE-2026-47162.patch: encode the value with string()\n       in runtime/autoload/netrw.vim; matches upstream patch 9.2.0495.\n     - CVE-2026-47162\n   * SECURITY UPDATE: code execution through Python omni-completion:\n     pythoncomplete and python3complete rebuilt the buffer's Python code\n     and passed it to exec(), including the import and from statements\n     harvested from the buffer, so invoking omni-completion in a hostile\n     Python file executed arbitrary module-level code.\n     - debian/patches/CVE-2026-52858.patch: skip import/from statements\n       unless g:pythoncomplete_allow_import is set, in both\n       runtime/autoload/pythoncomplete.vim and python3complete.vim;\n       matches upstream patches 9.2.0561 and 9.2.0568, the latter being\n       required for the opt-in to take effect at all.\n     - CVE-2026-52858\n   * SECURITY UPDATE: out-of-bounds access when a terminal buffer is\n     snapshotted: the per-cell loop in move_terminal_to_buffer() walked\n     cell.chars[] with no upper bound, and libvterm leaves that array\n     unterminated when a cell uses all VTERM_MAX_CHARS_PER_CELL slots (a\n     base character plus five combining marks), so it read past the array\n     and appended the out-of-bounds values to a buffer sized for far fewer\n     bytes.\n     - debian/patches/CVE-2026-52859.patch: bound the loop with\n       i \u003c VTERM_MAX_CHARS_PER_CELL and size the buffer for six 6-byte\n       characters, in src/terminal.c; matches upstream patch 9.2.0565\n       together with its prerequisite 8.1.0611, without which the bounded\n       loop would still overrun the MB_MAXBYTES-sized buffer.\n     - CVE-2026-52859\n   * SECURITY UPDATE: code execution through Python omni-completion\n     definition headers: Scope.get_code() reproduced def and class headers\n     verbatim in the source handed to exec(), and Python evaluates\n     parameter default values, annotations and base-class expressions at\n     definition time, so crafted headers ran arbitrary code during\n     completion even with imports disabled.\n     - debian/patches/CVE-2026-52860.patch: strip default values and\n       annotations from parameters and accept only dotted names as base\n       classes, in both runtime/autoload/pythoncomplete.vim and\n       python3complete.vim; matches upstream patch 9.2.0597.\n     - CVE-2026-52860\n   * SECURITY UPDATE: out-of-bounds write reading a crafted spell file:\n     tree_count_words() and sug_filltree() descended the word trie without\n     bounding the depth, so a deeply nested trie wrote past the ends of\n     their MAXWLEN-sized arridx[], curi[] and wordcount[] arrays.\n     - debian/patches/CVE-2026-55693.patch: only descend while\n       depth \u003c MAXWLEN - 1 in both trie walkers, in src/spellfile.c;\n       matches upstream patch 9.2.0653.\n     - CVE-2026-55693\n   * SECURITY UPDATE: code injection when netrw opens a remote file:\n     s:NetrwBrowse() passed bufname() unescaped into an :execute'd \"b\"\n     command, so a buffer name containing the Ex command separator ran\n     arbitrary Ex commands.\n     - debian/patches/CVE-2026-55895.patch: escape the name with\n       fnameescape() in runtime/autoload/netrw.vim; matches the applicable\n       hunk of upstream patch 9.2.0663.\n     - CVE-2026-55895\n   * SECURITY UPDATE: out-of-bounds write in SOFO soundfolding:\n     spell_soundfold_sofo() walked the input word without checking the\n     index into its MAXWLEN-sized result buffer, so a crafted spell file\n     with a long SOFO translation wrote past the end of it.\n     - debian/patches/CVE-2026-57455.patch: add the ri \u003c MAXWLEN - 1 abort\n       condition to the translation loop, in src/spell.c; matches upstream\n       patch 9.2.0698.\n     - CVE-2026-57455\n   * SECURITY UPDATE: code execution via doc strings in Python\n     omni-completion: get_code() wrapped the doc string harvested from the\n     buffer in triple quotes, so a doc string containing a triple quote\n     closed the literal and the remainder was executed as code during\n     completion.\n     - debian/patches/CVE-2026-57456.patch: quote doc strings with repr()\n       at all three generation sites in both\n       runtime/autoload/pythoncomplete.vim and python3complete.vim;\n       matches upstream patch 9.2.0699.\n     - CVE-2026-57456\n   * SECURITY UPDATE: arbitrary Ex command execution during C\n     omni-completion: s:StructMembers() interpolated the typeref field of a\n     tags entry into a :vimgrep pattern run through :execute, so a crafted\n     tags file could close the pattern and append an Ex command that ran\n     when C omni-completion was invoked on a hostile source file.\n     - debian/patches/CVE-2026-59858.patch: escape the type field with\n       escape(typename, '/\\') before building the pattern, in\n       runtime/autoload/ccomplete.vim; matches upstream patch 9.2.0735.\n     - CVE-2026-59858\n   * SECURITY UPDATE: the escaping above is not sufficient on its own: an\n     unclosed bracket in the typeref makes :vimgrep's pattern skipping\n     fail, after which a bar in the tag value is again treated as a command\n     separator and executed.\n     - debian/patches/CVE-2026-73073.patch: match the field literally with\n       \\V ... \\m instead of relying on escaping alone, in\n       runtime/autoload/ccomplete.vim; matches upstream patch 9.2.0845.\n     - CVE-2026-73073","modified":"2026-10-26T09:31:47.404553765Z","published":"2026-08-22T10:35:47Z","upstream":["CVE-2026-46483","CVE-2026-47162","CVE-2026-52858","CVE-2026-52859","CVE-2026-52860","CVE-2026-55693","CVE-2026-55895","CVE-2026-57455","CVE-2026-57456","CVE-2026-59858","CVE-2026-73073"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787394930.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46483"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47162"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52858"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52859"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52860"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55693"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55895"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57455"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57456"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59858"}],"affected":[{"package":{"name":"vim","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787394930.json"}},{"package":{"name":"vim-athena","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim-athena?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787394930.json"}},{"package":{"name":"vim-common","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim-common?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787394930.json"}},{"package":{"name":"vim-doc","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim-doc?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787394930.json"}},{"package":{"name":"vim-gnome","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim-gnome?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787394930.json"}},{"package":{"name":"vim-gtk","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim-gtk?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787394930.json"}},{"package":{"name":"vim-gtk3","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim-gtk3?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787394930.json"}},{"package":{"name":"vim-gui-common","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim-gui-common?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787394930.json"}},{"package":{"name":"vim-nox","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim-nox?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787394930.json"}},{"package":{"name":"vim-runtime","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim-runtime?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787394930.json"}},{"package":{"name":"vim-tiny","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/vim-tiny?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787394930.json"}},{"package":{"name":"xxd","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/xxd?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787394930.json"}}],"schema_version":"1.9.0"}