CLSA-2026-1787394930
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787394930.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1787394930
- Upstream
- Published
- 2026-08-22T10:35:47Z
- Modified
- 2026-10-26T09:31:47Z
- Summary
- Fix of 10 CVEs
- Details
-
- SECURITY UPDATE: command injection in the tar plugin: tar#Vimuntar()
escaped the tarball name with shellescape() without the special
argument before running gunzip/gzip through :!, so characters that Vim
expands in a :! command line (such as % and #) survived in the name
and let a crafted archive name run arbitrary shell commands.
- debian/patches/CVE-2026-46483.patch: use the shellescape(name, 1) form for both :! invocations in runtime/autoload/tar.vim; matches upstream patch 9.2.0479.
- CVE-2026-46483
- SECURITY UPDATE: code injection via netrw directory history:
s:NetrwBookHistSave() serialised each history entry into
~/.vim/.netrwhist by wrapping the value in single quotes with string
concatenation, so a directory name containing a single quote closed
the literal and injected Vimscript that ran when the history file was
sourced on the next netrw start.
- debian/patches/CVE-2026-47162.patch: encode the value with string() in runtime/autoload/netrw.vim; matches upstream patch 9.2.0495.
- CVE-2026-47162
- SECURITY UPDATE: code execution through Python omni-completion:
pythoncomplete and python3complete rebuilt the buffer's Python code
and passed it to exec(), including the import and from statements
harvested from the buffer, so invoking omni-completion in a hostile
Python file executed arbitrary module-level code.
- debian/patches/CVE-2026-52858.patch: skip import/from statements unless g:pythoncomplete_allow_import is set, in both runtime/autoload/pythoncomplete.vim and python3complete.vim; matches upstream patches 9.2.0561 and 9.2.0568, the latter being required for the opt-in to take effect at all.
- CVE-2026-52858
- SECURITY UPDATE: out-of-bounds access when a terminal buffer is
snapshotted: the per-cell loop in move_terminal_to_buffer() walked
cell.chars[] with no upper bound, and libvterm leaves that array
unterminated when a cell uses all VTERM_MAX_CHARS_PER_CELL slots (a
base character plus five combining marks), so it read past the array
and appended the out-of-bounds values to a buffer sized for far fewer
bytes.
- debian/patches/CVE-2026-52859.patch: bound the loop with i < VTERM_MAX_CHARS_PER_CELL and size the buffer for six 6-byte characters, in src/terminal.c; matches upstream patch 9.2.0565 together with its prerequisite 8.1.0611, without which the bounded loop would still overrun the MB_MAXBYTES-sized buffer.
- CVE-2026-52859
- SECURITY UPDATE: code execution through Python omni-completion
definition headers: Scope.get_code() reproduced def and class headers
verbatim in the source handed to exec(), and Python evaluates
parameter default values, annotations and base-class expressions at
definition time, so crafted headers ran arbitrary code during
completion even with imports disabled.
- debian/patches/CVE-2026-52860.patch: strip default values and annotations from parameters and accept only dotted names as base classes, in both runtime/autoload/pythoncomplete.vim and python3complete.vim; matches upstream patch 9.2.0597.
- CVE-2026-52860
- SECURITY UPDATE: out-of-bounds write reading a crafted spell file:
tree_count_words() and sug_filltree() descended the word trie without
bounding the depth, so a deeply nested trie wrote past the ends of
their MAXWLEN-sized arridx[], curi[] and wordcount[] arrays.
- debian/patches/CVE-2026-55693.patch: only descend while depth < MAXWLEN - 1 in both trie walkers, in src/spellfile.c; matches upstream patch 9.2.0653.
- CVE-2026-55693
- SECURITY UPDATE: code injection when netrw opens a remote file:
s:NetrwBrowse() passed bufname() unescaped into an :execute'd "b"
command, so a buffer name containing the Ex command separator ran
arbitrary Ex commands.
- debian/patches/CVE-2026-55895.patch: escape the name with fnameescape() in runtime/autoload/netrw.vim; matches the applicable hunk of upstream patch 9.2.0663.
- CVE-2026-55895
- SECURITY UPDATE: out-of-bounds write in SOFO soundfolding:
spell_soundfold_sofo() walked the input word without checking the
index into its MAXWLEN-sized result buffer, so a crafted spell file
with a long SOFO translation wrote past the end of it.
- debian/patches/CVE-2026-57455.patch: add the ri < MAXWLEN - 1 abort condition to the translation loop, in src/spell.c; matches upstream patch 9.2.0698.
- CVE-2026-57455
- SECURITY UPDATE: code execution via doc strings in Python
omni-completion: get_code() wrapped the doc string harvested from the
buffer in triple quotes, so a doc string containing a triple quote
closed the literal and the remainder was executed as code during
completion.
- debian/patches/CVE-2026-57456.patch: quote doc strings with repr() at all three generation sites in both runtime/autoload/pythoncomplete.vim and python3complete.vim; matches upstream patch 9.2.0699.
- CVE-2026-57456
- SECURITY UPDATE: arbitrary Ex command execution during C
omni-completion: s:StructMembers() interpolated the typeref field of a
tags entry into a :vimgrep pattern run through :execute, so a crafted
tags file could close the pattern and append an Ex command that ran
when C omni-completion was invoked on a hostile source file.
- debian/patches/CVE-2026-59858.patch: escape the type field with escape(typename, '/') before building the pattern, in runtime/autoload/ccomplete.vim; matches upstream patch 9.2.0735.
- CVE-2026-59858
- SECURITY UPDATE: the escaping above is not sufficient on its own: an
unclosed bracket in the typeref makes :vimgrep's pattern skipping
fail, after which a bar in the tag value is again treated as a command
separator and executed.
- debian/patches/CVE-2026-73073.patch: match the field literally with \V ... \m instead of relying on escaping alone, in runtime/autoload/ccomplete.vim; matches upstream patch 9.2.0845.
- CVE-2026-73073
- SECURITY UPDATE: command injection in the tar plugin: tar#Vimuntar()
escaped the tarball name with shellescape() without the special
argument before running gunzip/gzip through :!, so characters that Vim
expands in a :! command line (such as % and #) survived in the name
and let a crafted archive name run arbitrary shell commands.
- References
-
- https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787394930.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-46483
- https://nvd.nist.gov/vuln/detail/CVE-2026-47162
- https://nvd.nist.gov/vuln/detail/CVE-2026-52858
- https://nvd.nist.gov/vuln/detail/CVE-2026-52859
- https://nvd.nist.gov/vuln/detail/CVE-2026-52860
- https://nvd.nist.gov/vuln/detail/CVE-2026-55693
- https://nvd.nist.gov/vuln/detail/CVE-2026-55895
- https://nvd.nist.gov/vuln/detail/CVE-2026-57455
- https://nvd.nist.gov/vuln/detail/CVE-2026-57456
- https://nvd.nist.gov/vuln/detail/CVE-2026-59858