CLSA-2026-1787679179
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787679179.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1787679179
- Upstream
- Published
- 2026-08-25T17:33:09Z
- Modified
- 2026-10-26T09:32:03Z
- Summary
- Fix CVE(s): CVE-2022-3520
- Details
-
- SECURITY UPDATE: out-of-bounds read after a Visual block put: do_put()
set the '] mark as bd.textcol + totlen - 1 without a lower bound, so a
blockwise register whose lines are all empty (y_width becomes -1 in
str_to_reg(), giving totlen 0) left the column at -1. With 'selection'
set to exclusive, nv_put() then passed that mark to inc(), which
dereferenced a pointer before the start of the line buffer.
- debian/patches/CVE-2022-3520.patch: clamp curbuf->b_op_end.col to 0 in src/ops.c; matches upstream patch 9.0.0765.
- CVE-2022-3520
- SECURITY UPDATE: out-of-bounds read after a Visual block put: do_put()
set the '] mark as bd.textcol + totlen - 1 without a lower bound, so a
blockwise register whose lines are all empty (y_width becomes -1 in
str_to_reg(), giving totlen 0) left the column at -1. With 'selection'
set to exclusive, nv_put() then passed that mark to inc(), which
dereferenced a pointer before the start of the line buffer.
- References