CLSA-2026-1787304699
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787304699.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1787304699
- Upstream
- Published
- 2026-08-21T09:31:57Z
- Modified
- 2026-10-26T09:31:47Z
- Summary
- Fix of 10 CVEs
- Details
-
- SECURITY UPDATE: stack-based buffer overflow in option callback
functions: illegal_char() and did_set_string_option() wrote the
E539/E526/E535 option errors into the caller's 80-byte errbuf[] with
unbounded sprintf(). The call site reported upstream,
did_set_langmap() in src/map.c, does not exist in this version, where
'langmap' errors are reported through EMSG2() into a bounded buffer.
- debian/patches/CVE-2024-22667.patch: introduce ERR_BUFLEN and use snprintf() bounded by it at the three sprintf() sites, in src/option.c and src/option.h; matches upstream patch 9.0.2142.
- CVE-2024-22667
- SECURITY UPDATE: buffer overflow in 'helpfile' option handling:
get_tagfname() copied the user-controlled 'helpfile' value into a
MAXPATHL buffer with STRCPY() and then appended "tags" at the tail, so
an over-long 'helpfile' overflowed the buffer.
- debian/patches/CVE-2026-25749.patch: bound the copy with vim_strncpy() leaving room for the "tags" suffix, in src/tag.c; matches upstream patches 9.1.2132 and 9.1.2133.
- CVE-2026-25749
- SECURITY UPDATE: buffer overflow in the netbeans specialKeys command:
special_keys() walked the modifier prefix writing two bytes per
modifier into the 64-byte keybuf[] with no bound, so a long modifier
run overflowed it.
- debian/patches/CVE-2026-26269.patch: stop the modifier loop while i + 2 < KEYBUFLEN, in src/netbeans.c; matches upstream patch 9.1.2148.
- CVE-2026-26269
- SECURITY UPDATE: command injection via netrw URIs: the hostname and
port taken from a netrw URI were interpolated unescaped into the
command passed to system(), so shell metacharacters in the host or
port ran arbitrary commands.
- debian/patches/CVE-2026-28417.patch: validate the host against an RFC1123 hostname / IPv4 / IPv6 pattern at the four netrw entry points and shellescape() the host, user and port in s:MakeSshCmd(), in runtime/autoload/netrw.vim; matches upstream patches 9.2.0073, 9.2.0089 and 9.2.0553.
- CVE-2026-28417
- SECURITY UPDATE: crash and huge allocation recovering a corrupted swap
file: ml_recover() trusted pe_page_count, pe_bnum, pe_old_lnum and
pe_line_count from the swap file, so bogus values caused a multi-GB
mf_get() allocation or a SEGV inside readfile().
- debian/patches/CVE-2026-28421.patch: bound pe_page_count and pe_bnum against mf_blocknr_max and validate pe_old_lnum and pe_line_count before use, in src/memline.c; matches upstream patch 9.2.0077.
- CVE-2026-28421
- SECURITY UPDATE: command injection via newline in glob(): the newline
character was missing from SHELL_SPECIAL, so it was not escaped before
mch_expand_wildcards() handed the pattern to the shell and could act
as a command separator.
- debian/patches/CVE-2026-33412.patch: add '\n' to SHELL_SPECIAL, in src/os_unix.c; matches upstream patch 9.2.0202.
- CVE-2026-33412
- SECURITY UPDATE: modeline security bypass: several options holding
expressions could be set from a modeline, so opening a crafted file
evaluated attacker-supplied expressions. In this version the
expressions reachable this way are the 'statusline'-style %{} items of
'printheader' and 'guitabtooltip', which were evaluated in the sandbox
only; the F{func} flag of 'complete' and the mapset() function named by
the upstream advisory arrived in later releases and are not present in
this version.
- debian/patches/patch-8.1.1366-using-expressions-in-a-modeline-is-unsafe.patch: add the 'modelineexpr' option and the P_MLE flag, refuse P_MLE options in a modeline unless 'modelineexpr' is set, mark the expression-bearing options P_MLE, and document 'modelineexpr' and E992, in src/option.c, src/option.h and runtime/doc/options.txt; prerequisite for the fix below.
- debian/patches/patch-8.1.1367-can-set-modelineexpr-in-modeline.patch: mark 'modelineexpr' itself P_SECURE so a modeline cannot enable it, and document that, in src/option.c and runtime/doc/options.txt; without this the check above can be turned off by the crafted file itself.
- debian/patches/CVE-2026-34982.patch: mark 'complete', 'guitabtooltip' and 'printheader' P_MLE, in src/option.c; matches upstream patch 9.2.0276.
- CVE-2026-34982
- SECURITY UPDATE: path traversal in zip.vim: neither zip#Write() nor
zip#Extract() rejected archive members whose path escaped the
extraction directory, so a crafted zip could write outside it.
- debian/patches/CVE-2026-35177.patch: reject any path that simplifies to one containing "../" in both zip#Write() and zip#Extract(), in runtime/autoload/zip.vim; matches upstream patch 9.2.0280.
- CVE-2026-35177
- SECURITY UPDATE: command injection in the netbeans interface via
defineAnnoType: typeName, fg and bg arrived unvalidated from the
NetBeans server and were interpolated into an Ex command, so a bar
could append arbitrary commands; specialKeys likewise built a map
command from an unvalidated key token.
- debian/patches/CVE-2026-39881.patch: validate typeName, fg and bg against character allowlists and accept only alphanumerics and '-' in a specialKeys token, in src/netbeans.c; matches upstream patch 9.2.0316.
- CVE-2026-39881
- SECURITY UPDATE: command injection via backticks in tag files:
expand_tag_fname() passed a tag filename containing backticks to
wildcard expansion, which ran it through the shell.
- debian/patches/CVE-2026-41411.patch: refuse to expand a tag filename containing a backtick, in src/tag.c; matches upstream patch 9.2.0357.
- CVE-2026-41411
- NOTE: behaviour change that comes with the 'modelineexpr' mechanism above: options that hold an expression ('balloonexpr', 'foldexpr', 'foldtext', 'formatexpr', 'guitablabel', 'iconstring', 'includeexpr', 'indentexpr', 'rulerformat', 'statusline', 'tabline', 'titlestring', 'complete', 'guitabtooltip' and 'printheader') can no longer be set from a modeline unless the new 'modelineexpr' option is on, and are refused with E992. 'cdpath' becomes modeline- and sandbox-refused (E520). This is the upstream 8.1.1366 behaviour; see :help modelineexpr.
- debian/patches/fix-Test_terminal_cwd.patch: join the first two terminal lines before comparing in Test_terminal_cwd(), so the test still passes when the build path is long enough for the pwd output to wrap; matches upstream patch 9.0.0541.
- SECURITY UPDATE: stack-based buffer overflow in option callback
functions: illegal_char() and did_set_string_option() wrote the
E539/E526/E535 option errors into the caller's 80-byte errbuf[] with
unbounded sprintf(). The call site reported upstream,
did_set_langmap() in src/map.c, does not exist in this version, where
'langmap' errors are reported through EMSG2() into a bounded buffer.
- References
-
- https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787304699.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-22667
- https://nvd.nist.gov/vuln/detail/CVE-2026-25749
- https://nvd.nist.gov/vuln/detail/CVE-2026-26269
- https://nvd.nist.gov/vuln/detail/CVE-2026-28417
- https://nvd.nist.gov/vuln/detail/CVE-2026-28421
- https://nvd.nist.gov/vuln/detail/CVE-2026-33412
- https://nvd.nist.gov/vuln/detail/CVE-2026-34982
- https://nvd.nist.gov/vuln/detail/CVE-2026-35177
- https://nvd.nist.gov/vuln/detail/CVE-2026-39881
- https://nvd.nist.gov/vuln/detail/CVE-2026-41411