CLSA-2026-1787649192
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787649192.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1787649192
- Upstream
- Published
- 2026-08-25T09:13:25Z
- Modified
- 2026-10-26T09:31:34Z
- Summary
- Fix CVE(s): CVE-2026-73072, CVE-2026-73076, CVE-2026-73078
- Details
-
- SECURITY UPDATE: Heap buffer overflow in set_sofo() in src/spellfile.c: a crafted spell file with an SN_SAL section before an SN_SOFO section leaves sl_sal_first[] entries at -1, so the counting loop under-counts multi-byte mapping lists and later writes run past the end of an undersized heap allocation
- debian/patches/CVE-2026-73072.patch: reset sl_sal_first[] with vim_memset() at the top of the SN_SOFO counting loop in set_sofo(), as done upstream in patch 9.2.0846, so entries left at -1 by a preceding set_sal_first() can no longer skew the item counts
- CVE-2026-73072
- SECURITY UPDATE: Code execution via a crafted vimball archive: a member named .VimballRecord overwrites the un-vimball bookkeeping file with attacker-chosen Ex commands that are later :executed verbatim by vimball#RmVimball(), allowing arbitrary OS command execution through :!
- debian/patches/CVE-2026-73076.patch: forbid extracting a vimball member named .VimballRecord, record file deletions with string() quoting, and make vimball#RmVimball() execute only whitelisted call delete('...') entries instead of the whole record line (upstream patch 9.2.0847 adapted to vimball v37)
- CVE-2026-73076
- SECURITY UPDATE: Code injection in netrw bookmark, history and target menus: paths are interpolated into :execute'd :menu commands escaped with g:netrw_menu_escape, which lacks the Ex separator '|', so a crafted directory path breaks out of the :menu command and runs arbitrary Ex/shell commands
- debian/patches/CVE-2026-73078.patch: add '|' to g:netrw_menu_escape, escape the :e menu targets with escape(fnameescape(...),'|') in s:NetrwBookmarkMenu(), and quote the netrw#MakeTgt() arguments with string() in s:NetrwTgtMenu() (upstream patch 9.2.0840 adapted to netrw v156)
- CVE-2026-73078
- SECURITY UPDATE: Heap buffer overflow in set_sofo() in src/spellfile.c: a crafted spell file with an SN_SAL section before an SN_SOFO section leaves sl_sal_first[] entries at -1, so the counting loop under-counts multi-byte mapping lists and later writes run past the end of an undersized heap allocation
- References