{"id":"CVE-2026-73076","aliases":["ALPINE-CVE-2026-73076","ALSA-2026:66336","ALSA-2026:66348","ALSA-2026:66366","AZL-95562","BELL-CVE-2026-73076","CLSA-2026-1787649192","CLSA-2026-1787672129","CLSA-2026-1788171117","CLSA-2026-1789464361","CLSA-2026-1789464719","CLSA-2026-1789464785","CLSA-2026-1789466646","CLSA-2026-1791426968","CLSA-2026-1791427864","CLSA-2026-1791476847","CLSA-2026-1791478209","DEBIAN-CVE-2026-73076","EUVD-2026-56231","GHSA-r22p-fhw4-84p2","MGASA-2026-0355","OESA-2026-3593","OESA-2026-3594","OESA-2026-3595","OESA-2026-3596","OESA-2026-3859","RHSA-2026:66336","RHSA-2026:66348","RHSA-2026:66366","RHSA-2026:68711","RHSA-2026:70818","RHSA-2026:72465","RHSA-2026:72466","RLSA-2026:66336","RLSA-2026:66348","RLSA-2026:66366","ROOT-OS-DEBIAN-11-CVE-2026-73076","ROOT-OS-DEBIAN-12-CVE-2026-73076","SUSE-SU-2026:23190-1","SUSE-SU-2026:23365-1","SUSE-SU-2026:23391-1","SUSE-SU-2026:23393-1","SUSE-SU-2026:23552-1","SUSE-SU-2026:3677-1","SUSE-SU-2026:3679-1","SUSE-SU-2026:3680-1","UBUNTU-CVE-2026-73076","USN-8657-1","openSUSE-SU-2026:21671-1"],"status":"published","title":"Vim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`","description":"Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.","severity":{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00134,"percentile":0.02961,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-829","CWE-94"],"published":"2026-08-11T15:37:59Z","modified":"2026-11-03T06:33:05Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"vim","fixed_in":["9.2.0854-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"vim","fixed_in":["9.2.0854-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"vim","fixed_in":["9.2.0957-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"vim","fixed_in":["9.2.0854-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"vim","fixed_in":["9.2.0854-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"vim","fixed_in":["9.2.0854-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"vim-X11","fixed_in":["2:7.4.629-8.0.3.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"vim-common","fixed_in":["2:7.4.629-8.0.3.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"vim-enhanced","fixed_in":["2:7.4.629-8.0.3.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"vim-filesystem","fixed_in":["2:7.4.629-8.0.3.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"vim-minimal","fixed_in":["2:7.4.629-8.0.3.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"vim-X11","fixed_in":["2:7.4.629-8.0.3.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"vim-common","fixed_in":["2:7.4.629-8.0.3.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"vim-enhanced","fixed_in":["2:7.4.629-8.0.3.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"vim-filesystem","fixed_in":["2:7.4.629-8.0.3.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"vim-minimal","fixed_in":["2:7.4.629-8.0.3.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vim","fixed_in":["2:9.1.1230-2+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vim","fixed_in":["2:9.2.0858-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"vim","fixed_in":["2:8.2.2434-3+deb11u3.aikido.5","2:8.2.2434-3+deb11u3.aikido.6","2:8.2.2434-3+deb11u3.aikido.7","2:8.2.2434-3+deb11u3.aikido.8"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-vim","fixed_in":["2:8.2.2434-3+deb11u3.aikido.5","2:8.2.2434-3+deb11u3.aikido.6","2:8.2.2434-3+deb11u3.aikido.7","2:8.2.2434-3+deb11u3.aikido.8"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"vim","fixed_in":["2:9.0.1378-2+deb12u2.aikido.20","2:9.0.1378-2+deb12u2.aikido.21"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-vim","fixed_in":["2:9.0.1378-2+deb12u2.aikido.20","2:9.0.1378-2+deb12u2.aikido.21"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vim","fixed_in":["2:7.4.052-1ubuntu3.1+esm32"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vim","fixed_in":["2:7.4.1689-3ubuntu1.5+esm38"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vim","fixed_in":["2:8.0.1453-1ubuntu1.13+esm23"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"vim","fixed_in":["2:8.1.2269-1ubuntu5.32+esm12"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"vim","fixed_in":["2:8.2.3995-1ubuntu2.35"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"vim","fixed_in":["2:9.1.0016-1ubuntu7.19"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"vim","fixed_in":["2:9.1.2141-1ubuntu4.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0854-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0854-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.083-9.el10_2.20"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.083-9.el10_2.20"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"vim-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.083-9.el10_2.20"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.083-9.el10_2.20"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.083-9.el10_2.20"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.083-9.el10_2.20"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"xxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.083-9.el10_2.20"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-31.el8_10.7"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-31.el8_10.7"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-31.el8_10.7"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-31.el8_10.7"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-31.el8_10.7"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-26.el9_8.21"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-26.el9_8.21"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-26.el9_8.21"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-26.el9_8.21"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-26.el9_8.21"}]}],"bundled":8},{"source":"osv","ecosystem":"Azure Linux:3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0820-r2"},{"fixed":"9.2.0854-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1.1415-r0"},{"fixed":"9.2.0854-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.1395-r0"},{"fixed":"9.2.0854-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-athena","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-gui-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"vim-tiny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"xxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+tuxcare.els3"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els72"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-athena","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els72"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-athena-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els72"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els72"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els72"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els72"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gnome-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els72"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els72"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els72"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els72"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gtk3-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els72"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-gui-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els72"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els72"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-nox-py2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els72"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els72"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"vim-tiny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.1689-3ubuntu1.5+tuxcare.els72"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els27"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim-athena","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els27"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els27"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els27"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els27"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim-gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els27"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim-gui-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els27"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim-nox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els27"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els27"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"vim-tiny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els27"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"xxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.0875-5+deb10u6+tuxcare.els27"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-16.el8.tuxcare.els24"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-16.el8.tuxcare.els24"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-16.el8.tuxcare.els24"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-16.el8.tuxcare.els24"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-16.el8.tuxcare.els24"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-16.el8.tuxcare.els24"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-16.el8.tuxcare.els24"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-16.el8.tuxcare.els24"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-16.el8.tuxcare.els24"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-16.el8.tuxcare.els24"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-19.el8.4.tuxcare.els23"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-19.el8.4.tuxcare.els23"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-19.el8.4.tuxcare.els23"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-19.el8.4.tuxcare.els23"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-19.el8.4.tuxcare.els23"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.1.tuxcare.els41"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.1.tuxcare.els41"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.1.tuxcare.els41"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.1.tuxcare.els41"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.1.tuxcare.els41"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els63"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els63"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els63"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els63"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els63"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els63"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els63"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els63"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els63"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:7.4.629-5.2.el6.tuxcare.els63"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.3.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.3.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.3.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.3.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.3.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.3.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.3.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.3.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.3.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.3.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:9.0.1378-2","2:9.0.1378-2+deb12u1","2:9.0.1378-2+deb12u2","2:9.0.1658-1","2:9.0.1672-1","2:9.0.1894-1","2:9.0.2018-1","2:9.0.2087-1","2:9.0.2103-1","2:9.0.2116-1","2:9.0.2189-1","2:9.1.0-1","2:9.1.0016-1","2:9.1.0199-1","2:9.1.0374-1","2:9.1.0377-1","2:9.1.0496-1","2:9.1.0698-1","2:9.1.0709-1","2:9.1.0709-2","2:9.1.0777-1","2:9.1.0861-1","2:9.1.0967-1","2:9.1.0967-2","2:9.1.1113-1","2:9.1.1230-1","2:9.1.1230-2","2:9.1.1385-1","2:9.1.1766-1","2:9.1.1829-1","2:9.1.1846-1","2:9.1.1882-1","2:9.1.2103-1","2:9.1.2141-1","2:9.2.0119-1","2:9.2.0136-1","2:9.2.0218-1","2:9.2.0315-1","2:9.2.0338-1","2:9.2.0355-1","2:9.2.0428-1","2:9.2.0461-1","2:9.2.0524-1","2:9.2.0782-1","2:9.2.0858-1"]},{"source":"osv","ecosystem":"Debian:13","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.1230-2+deb13u1"}]}],"versions":["2:9.1.1230-2"]},{"source":"osv","ecosystem":"Debian:14","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.2.0858-1"}]}],"versions":["2:9.1.1230-2","2:9.1.1385-1","2:9.1.1766-1","2:9.1.1829-1","2:9.1.1846-1","2:9.1.1882-1","2:9.1.2103-1","2:9.1.2141-1","2:9.2.0119-1","2:9.2.0136-1","2:9.2.0218-1","2:9.2.0315-1","2:9.2.0338-1","2:9.2.0355-1","2:9.2.0428-1","2:9.2.0461-1","2:9.2.0524-1","2:9.2.0782-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.1011-2.mga10"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:9","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.1011-2.mga9"}]}],"bundled":9},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-58.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2092-45.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2092-45.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-59.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2092-45.oe2403sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.083-9.el10_2.20"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.083-9.el10_2.20"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.083-9.el10_2.20"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.083-9.el10_2.20"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-31.el8_10.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-31.el8_10.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-31.el8_10.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-31.el8_10.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-26.el9_8.21"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-26.el9_8.21"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-26.el9_8.21"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-26.el9_8.21"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.el7_9.2"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.el7_9.2"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.el7_9.2"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.el7_9.2"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.el7_9.2"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"vim-X11-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"vim-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"vim-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"vim-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"vim-enhanced-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"vim-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"vim-X11-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"vim-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"vim-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"vim-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"vim-enhanced-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"vim-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-22.el9_6.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_4.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"vim-X11-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_4.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_4.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"vim-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_4.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"vim-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_4.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"vim-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_4.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_4.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"vim-enhanced-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_4.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"vim-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_4.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_4.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"vim-X11-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_4.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"vim-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_4.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"vim-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_4.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"vim-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_4.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"vim-enhanced-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_4.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_4.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_4.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"vim-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_4.4"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_2.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"vim-X11-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_2.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_2.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"vim-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_2.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"vim-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_2.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"vim-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_2.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_2.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"vim-enhanced-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_2.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"vim-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_2.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_2.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"vim-X11-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_2.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"vim-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_2.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"vim-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_2.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"vim-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_2.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"vim-enhanced-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_2.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_2.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_2.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"vim-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-20.el9_2.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Rocky Linux:10","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.083-9.el10_2.20"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1763-31.el8_10.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2637-26.el9_8.21"}]}],"bundled":8},{"source":"osv","ecosystem":"Root:Debian:11","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2434-3+deb11u3.aikido.5"},{"fixed":"2:8.2.2434-3+deb11u3.aikido.6"},{"fixed":"2:8.2.2434-3+deb11u3.aikido.7"},{"fixed":"2:8.2.2434-3+deb11u3.aikido.8"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.2434-3+deb11u3.aikido.5"},{"fixed":"2:8.2.2434-3+deb11u3.aikido.6"},{"fixed":"2:8.2.2434-3+deb11u3.aikido.7"},{"fixed":"2:8.2.2434-3+deb11u3.aikido.8"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.0.1378-2+deb12u2.aikido.20"},{"fixed":"2:9.0.1378-2+deb12u2.aikido.21"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.0.1378-2+deb12u2.aikido.20"},{"fixed":"2:9.0.1378-2+deb12u2.aikido.21"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-slfo.1.1_1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro Extras 6.2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-160000.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-160000.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-160000.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-160000.1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-17.76.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-17.76.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-150000.5.102.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-150000.5.102.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-150500.20.64.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-150500.20.64.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-150500.20.64.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-150500.20.64.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-150500.20.64.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-150500.20.64.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-150500.20.64.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-150500.20.64.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-150500.20.64.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.052-1ubuntu3.1+esm32"}]}],"versions":["2:7.4.000-1ubuntu2","2:7.4.052-1ubuntu1","2:7.4.052-1ubuntu2","2:7.4.052-1ubuntu3","2:7.4.052-1ubuntu3.1","2:7.4.052-1ubuntu3.1+esm1","2:7.4.052-1ubuntu3.1+esm3","2:7.4.052-1ubuntu3.1+esm4","2:7.4.052-1ubuntu3.1+esm5","2:7.4.052-1ubuntu3.1+esm6","2:7.4.052-1ubuntu3.1+esm7","2:7.4.052-1ubuntu3.1+esm8","2:7.4.052-1ubuntu3.1+esm9","2:7.4.052-1ubuntu3.1+esm10","2:7.4.052-1ubuntu3.1+esm11","2:7.4.052-1ubuntu3.1+esm12","2:7.4.052-1ubuntu3.1+esm13","2:7.4.052-1ubuntu3.1+esm14","2:7.4.052-1ubuntu3.1+esm15","2:7.4.052-1ubuntu3.1+esm16","2:7.4.052-1ubuntu3.1+esm17","2:7.4.052-1ubuntu3.1+esm18","2:7.4.052-1ubuntu3.1+esm19","2:7.4.052-1ubuntu3.1+esm20","2:7.4.052-1ubuntu3.1+esm21","2:7.4.052-1ubuntu3.1+esm22","2:7.4.052-1ubuntu3.1+esm23","2:7.4.052-1ubuntu3.1+esm24","2:7.4.052-1ubuntu3.1+esm25","2:7.4.052-1ubuntu3.1+esm26","2:7.4.052-1ubuntu3.1+esm27","2:7.4.052-1ubuntu3.1+esm28","2:7.4.052-1ubuntu3.1+esm29","2:7.4.052-1ubuntu3.1+esm30","2:7.4.052-1ubuntu3.1+esm31"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.1689-3ubuntu1.5+esm38"}]}],"versions":["2:7.4.712-2ubuntu4","2:7.4.826-1ubuntu1","2:7.4.826-1ubuntu2","2:7.4.826-1ubuntu3","2:7.4.963-1ubuntu1","2:7.4.963-1ubuntu4","2:7.4.963-1ubuntu5","2:7.4.1689-3ubuntu1","2:7.4.1689-3ubuntu1.1","2:7.4.1689-3ubuntu1.2","2:7.4.1689-3ubuntu1.3","2:7.4.1689-3ubuntu1.4","2:7.4.1689-3ubuntu1.5","2:7.4.1689-3ubuntu1.5+esm2","2:7.4.1689-3ubuntu1.5+esm3","2:7.4.1689-3ubuntu1.5+esm4","2:7.4.1689-3ubuntu1.5+esm5","2:7.4.1689-3ubuntu1.5+esm6","2:7.4.1689-3ubuntu1.5+esm7","2:7.4.1689-3ubuntu1.5+esm8","2:7.4.1689-3ubuntu1.5+esm10","2:7.4.1689-3ubuntu1.5+esm11","2:7.4.1689-3ubuntu1.5+esm12","2:7.4.1689-3ubuntu1.5+esm13","2:7.4.1689-3ubuntu1.5+esm14","2:7.4.1689-3ubuntu1.5+esm15","2:7.4.1689-3ubuntu1.5+esm17","2:7.4.1689-3ubuntu1.5+esm18","2:7.4.1689-3ubuntu1.5+esm19","2:7.4.1689-3ubuntu1.5+esm20","2:7.4.1689-3ubuntu1.5+esm22","2:7.4.1689-3ubuntu1.5+esm23","2:7.4.1689-3ubuntu1.5+esm24","2:7.4.1689-3ubuntu1.5+esm25","2:7.4.1689-3ubuntu1.5+esm26","2:7.4.1689-3ubuntu1.5+esm27","2:7.4.1689-3ubuntu1.5+esm28","2:7.4.1689-3ubuntu1.5+esm29","2:7.4.1689-3ubuntu1.5+esm30","2:7.4.1689-3ubuntu1.5+esm31","2:7.4.1689-3ubuntu1.5+esm32","2:7.4.1689-3ubuntu1.5+esm33","2:7.4.1689-3ubuntu1.5+esm34","2:7.4.1689-3ubuntu1.5+esm35","2:7.4.1689-3ubuntu1.5+esm36","2:7.4.1689-3ubuntu1.5+esm37"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+esm23"}]}],"versions":["2:8.0.0197-4ubuntu5","2:8.0.1144-1ubuntu1","2:8.0.1401-1ubuntu1","2:8.0.1401-1ubuntu2","2:8.0.1401-1ubuntu3","2:8.0.1453-1ubuntu1","2:8.0.1453-1ubuntu1.1","2:8.0.1453-1ubuntu1.3","2:8.0.1453-1ubuntu1.4","2:8.0.1453-1ubuntu1.6","2:8.0.1453-1ubuntu1.7","2:8.0.1453-1ubuntu1.8","2:8.0.1453-1ubuntu1.9","2:8.0.1453-1ubuntu1.10","2:8.0.1453-1ubuntu1.11","2:8.0.1453-1ubuntu1.12","2:8.0.1453-1ubuntu1.13","2:8.0.1453-1ubuntu1.13+esm1","2:8.0.1453-1ubuntu1.13+esm3","2:8.0.1453-1ubuntu1.13+esm4","2:8.0.1453-1ubuntu1.13+esm5","2:8.0.1453-1ubuntu1.13+esm6","2:8.0.1453-1ubuntu1.13+esm7","2:8.0.1453-1ubuntu1.13+esm8","2:8.0.1453-1ubuntu1.13+esm9","2:8.0.1453-1ubuntu1.13+esm10","2:8.0.1453-1ubuntu1.13+esm11","2:8.0.1453-1ubuntu1.13+esm12","2:8.0.1453-1ubuntu1.13+esm13","2:8.0.1453-1ubuntu1.13+esm14","2:8.0.1453-1ubuntu1.13+esm15","2:8.0.1453-1ubuntu1.13+esm16","2:8.0.1453-1ubuntu1.13+esm17","2:8.0.1453-1ubuntu1.13+esm18","2:8.0.1453-1ubuntu1.13+esm19","2:8.0.1453-1ubuntu1.13+esm20","2:8.0.1453-1ubuntu1.13+esm21","2:8.0.1453-1ubuntu1.13+esm22"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.2269-1ubuntu5.32+esm12"}]}],"versions":["2:8.1.0875-5ubuntu2","2:8.1.0875-5ubuntu3","2:8.1.0875-5ubuntu4","2:8.1.2269-1ubuntu1","2:8.1.2269-1ubuntu4","2:8.1.2269-1ubuntu5","2:8.1.2269-1ubuntu5.3","2:8.1.2269-1ubuntu5.4","2:8.1.2269-1ubuntu5.6","2:8.1.2269-1ubuntu5.7","2:8.1.2269-1ubuntu5.8","2:8.1.2269-1ubuntu5.9","2:8.1.2269-1ubuntu5.11","2:8.1.2269-1ubuntu5.12","2:8.1.2269-1ubuntu5.13","2:8.1.2269-1ubuntu5.14","2:8.1.2269-1ubuntu5.15","2:8.1.2269-1ubuntu5.16","2:8.1.2269-1ubuntu5.17","2:8.1.2269-1ubuntu5.18","2:8.1.2269-1ubuntu5.20","2:8.1.2269-1ubuntu5.21","2:8.1.2269-1ubuntu5.22","2:8.1.2269-1ubuntu5.23","2:8.1.2269-1ubuntu5.24","2:8.1.2269-1ubuntu5.25","2:8.1.2269-1ubuntu5.26","2:8.1.2269-1ubuntu5.29","2:8.1.2269-1ubuntu5.30","2:8.1.2269-1ubuntu5.31","2:8.1.2269-1ubuntu5.32","2:8.1.2269-1ubuntu5.32+esm2","2:8.1.2269-1ubuntu5.32+esm3","2:8.1.2269-1ubuntu5.32+esm4","2:8.1.2269-1ubuntu5.32+esm5","2:8.1.2269-1ubuntu5.32+esm6","2:8.1.2269-1ubuntu5.32+esm7","2:8.1.2269-1ubuntu5.32+esm8","2:8.1.2269-1ubuntu5.32+esm9","2:8.1.2269-1ubuntu5.32+esm10"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.3995-1ubuntu2.35"}]}],"versions":["2:8.2.2434-3ubuntu3","2:8.2.2434-3ubuntu4","2:8.2.3565-1ubuntu1","2:8.2.3565-1ubuntu2","2:8.2.3565-1ubuntu3","2:8.2.3565-1ubuntu5","2:8.2.3995-1ubuntu1","2:8.2.3995-1ubuntu2","2:8.2.3995-1ubuntu2.1","2:8.2.3995-1ubuntu2.3","2:8.2.3995-1ubuntu2.4","2:8.2.3995-1ubuntu2.5","2:8.2.3995-1ubuntu2.7","2:8.2.3995-1ubuntu2.8","2:8.2.3995-1ubuntu2.9","2:8.2.3995-1ubuntu2.10","2:8.2.3995-1ubuntu2.11","2:8.2.3995-1ubuntu2.12","2:8.2.3995-1ubuntu2.13","2:8.2.3995-1ubuntu2.15","2:8.2.3995-1ubuntu2.16","2:8.2.3995-1ubuntu2.17","2:8.2.3995-1ubuntu2.18","2:8.2.3995-1ubuntu2.19","2:8.2.3995-1ubuntu2.20","2:8.2.3995-1ubuntu2.21","2:8.2.3995-1ubuntu2.22","2:8.2.3995-1ubuntu2.23","2:8.2.3995-1ubuntu2.24","2:8.2.3995-1ubuntu2.26","2:8.2.3995-1ubuntu2.27","2:8.2.3995-1ubuntu2.28","2:8.2.3995-1ubuntu2.29","2:8.2.3995-1ubuntu2.30","2:8.2.3995-1ubuntu2.31","2:8.2.3995-1ubuntu2.32","2:8.2.3995-1ubuntu2.33","2:8.2.3995-1ubuntu2.34"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.0016-1ubuntu7.19"}]}],"versions":["2:9.0.1672-1ubuntu2","2:9.0.2087-1ubuntu1","2:9.0.2116-1ubuntu1","2:9.0.2116-1ubuntu2","2:9.0.2184-0ubuntu1","2:9.0.2189-1ubuntu1","2:9.1.0-1ubuntu1","2:9.1.0016-1ubuntu2","2:9.1.0016-1ubuntu6","2:9.1.0016-1ubuntu7","2:9.1.0016-1ubuntu7.1","2:9.1.0016-1ubuntu7.2","2:9.1.0016-1ubuntu7.3","2:9.1.0016-1ubuntu7.4","2:9.1.0016-1ubuntu7.5","2:9.1.0016-1ubuntu7.6","2:9.1.0016-1ubuntu7.7","2:9.1.0016-1ubuntu7.8","2:9.1.0016-1ubuntu7.9","2:9.1.0016-1ubuntu7.10","2:9.1.0016-1ubuntu7.11","2:9.1.0016-1ubuntu7.12","2:9.1.0016-1ubuntu7.13","2:9.1.0016-1ubuntu7.14","2:9.1.0016-1ubuntu7.15","2:9.1.0016-1ubuntu7.16","2:9.1.0016-1ubuntu7.17","2:9.1.0016-1ubuntu7.18"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.2141-1ubuntu4.8"}]}],"versions":["2:9.1.0967-1ubuntu6","2:9.1.1882-1ubuntu1","2:9.1.1882-1ubuntu2","2:9.1.2141-1ubuntu1","2:9.1.2141-1ubuntu2","2:9.1.2141-1ubuntu4","2:9.1.2141-1ubuntu4.1","2:9.1.2141-1ubuntu4.2","2:9.1.2141-1ubuntu4.3","2:9.1.2141-1ubuntu4.5","2:9.1.2141-1ubuntu4.6","2:9.1.2141-1ubuntu4.7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.052-1ubuntu3.1+esm32"}]}],"versions":["2:7.4.000-1ubuntu2","2:7.4.052-1ubuntu1","2:7.4.052-1ubuntu2","2:7.4.052-1ubuntu3","2:7.4.052-1ubuntu3.1","2:7.4.052-1ubuntu3.1+esm1","2:7.4.052-1ubuntu3.1+esm3","2:7.4.052-1ubuntu3.1+esm4","2:7.4.052-1ubuntu3.1+esm5","2:7.4.052-1ubuntu3.1+esm6","2:7.4.052-1ubuntu3.1+esm7","2:7.4.052-1ubuntu3.1+esm8","2:7.4.052-1ubuntu3.1+esm9","2:7.4.052-1ubuntu3.1+esm10","2:7.4.052-1ubuntu3.1+esm11","2:7.4.052-1ubuntu3.1+esm12","2:7.4.052-1ubuntu3.1+esm13","2:7.4.052-1ubuntu3.1+esm14","2:7.4.052-1ubuntu3.1+esm15","2:7.4.052-1ubuntu3.1+esm16","2:7.4.052-1ubuntu3.1+esm17","2:7.4.052-1ubuntu3.1+esm18","2:7.4.052-1ubuntu3.1+esm19","2:7.4.052-1ubuntu3.1+esm20","2:7.4.052-1ubuntu3.1+esm21","2:7.4.052-1ubuntu3.1+esm22","2:7.4.052-1ubuntu3.1+esm23","2:7.4.052-1ubuntu3.1+esm24","2:7.4.052-1ubuntu3.1+esm25","2:7.4.052-1ubuntu3.1+esm26","2:7.4.052-1ubuntu3.1+esm27","2:7.4.052-1ubuntu3.1+esm28","2:7.4.052-1ubuntu3.1+esm29","2:7.4.052-1ubuntu3.1+esm30","2:7.4.052-1ubuntu3.1+esm31"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.1689-3ubuntu1.5+esm38"}]}],"versions":["2:7.4.712-2ubuntu4","2:7.4.826-1ubuntu1","2:7.4.826-1ubuntu2","2:7.4.826-1ubuntu3","2:7.4.963-1ubuntu1","2:7.4.963-1ubuntu4","2:7.4.963-1ubuntu5","2:7.4.1689-3ubuntu1","2:7.4.1689-3ubuntu1.1","2:7.4.1689-3ubuntu1.2","2:7.4.1689-3ubuntu1.3","2:7.4.1689-3ubuntu1.4","2:7.4.1689-3ubuntu1.5","2:7.4.1689-3ubuntu1.5+esm2","2:7.4.1689-3ubuntu1.5+esm3","2:7.4.1689-3ubuntu1.5+esm4","2:7.4.1689-3ubuntu1.5+esm5","2:7.4.1689-3ubuntu1.5+esm6","2:7.4.1689-3ubuntu1.5+esm7","2:7.4.1689-3ubuntu1.5+esm8","2:7.4.1689-3ubuntu1.5+esm10","2:7.4.1689-3ubuntu1.5+esm11","2:7.4.1689-3ubuntu1.5+esm12","2:7.4.1689-3ubuntu1.5+esm13","2:7.4.1689-3ubuntu1.5+esm14","2:7.4.1689-3ubuntu1.5+esm15","2:7.4.1689-3ubuntu1.5+esm17","2:7.4.1689-3ubuntu1.5+esm18","2:7.4.1689-3ubuntu1.5+esm19","2:7.4.1689-3ubuntu1.5+esm20","2:7.4.1689-3ubuntu1.5+esm22","2:7.4.1689-3ubuntu1.5+esm23","2:7.4.1689-3ubuntu1.5+esm24","2:7.4.1689-3ubuntu1.5+esm25","2:7.4.1689-3ubuntu1.5+esm26","2:7.4.1689-3ubuntu1.5+esm27","2:7.4.1689-3ubuntu1.5+esm28","2:7.4.1689-3ubuntu1.5+esm29","2:7.4.1689-3ubuntu1.5+esm30","2:7.4.1689-3ubuntu1.5+esm31","2:7.4.1689-3ubuntu1.5+esm32","2:7.4.1689-3ubuntu1.5+esm33","2:7.4.1689-3ubuntu1.5+esm34","2:7.4.1689-3ubuntu1.5+esm35","2:7.4.1689-3ubuntu1.5+esm36","2:7.4.1689-3ubuntu1.5+esm37"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+esm23"}]}],"versions":["2:8.0.0197-4ubuntu5","2:8.0.1144-1ubuntu1","2:8.0.1401-1ubuntu1","2:8.0.1401-1ubuntu2","2:8.0.1401-1ubuntu3","2:8.0.1453-1ubuntu1","2:8.0.1453-1ubuntu1.1","2:8.0.1453-1ubuntu1.3","2:8.0.1453-1ubuntu1.4","2:8.0.1453-1ubuntu1.6","2:8.0.1453-1ubuntu1.7","2:8.0.1453-1ubuntu1.8","2:8.0.1453-1ubuntu1.9","2:8.0.1453-1ubuntu1.10","2:8.0.1453-1ubuntu1.11","2:8.0.1453-1ubuntu1.12","2:8.0.1453-1ubuntu1.13","2:8.0.1453-1ubuntu1.13+esm1","2:8.0.1453-1ubuntu1.13+esm3","2:8.0.1453-1ubuntu1.13+esm4","2:8.0.1453-1ubuntu1.13+esm5","2:8.0.1453-1ubuntu1.13+esm6","2:8.0.1453-1ubuntu1.13+esm7","2:8.0.1453-1ubuntu1.13+esm8","2:8.0.1453-1ubuntu1.13+esm9","2:8.0.1453-1ubuntu1.13+esm10","2:8.0.1453-1ubuntu1.13+esm11","2:8.0.1453-1ubuntu1.13+esm12","2:8.0.1453-1ubuntu1.13+esm13","2:8.0.1453-1ubuntu1.13+esm14","2:8.0.1453-1ubuntu1.13+esm15","2:8.0.1453-1ubuntu1.13+esm16","2:8.0.1453-1ubuntu1.13+esm17","2:8.0.1453-1ubuntu1.13+esm18","2:8.0.1453-1ubuntu1.13+esm19","2:8.0.1453-1ubuntu1.13+esm20","2:8.0.1453-1ubuntu1.13+esm21","2:8.0.1453-1ubuntu1.13+esm22"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.2269-1ubuntu5.32+esm12"}]}],"versions":["2:8.1.0875-5ubuntu2","2:8.1.0875-5ubuntu3","2:8.1.0875-5ubuntu4","2:8.1.2269-1ubuntu1","2:8.1.2269-1ubuntu4","2:8.1.2269-1ubuntu5","2:8.1.2269-1ubuntu5.3","2:8.1.2269-1ubuntu5.4","2:8.1.2269-1ubuntu5.6","2:8.1.2269-1ubuntu5.7","2:8.1.2269-1ubuntu5.8","2:8.1.2269-1ubuntu5.9","2:8.1.2269-1ubuntu5.11","2:8.1.2269-1ubuntu5.12","2:8.1.2269-1ubuntu5.13","2:8.1.2269-1ubuntu5.14","2:8.1.2269-1ubuntu5.15","2:8.1.2269-1ubuntu5.16","2:8.1.2269-1ubuntu5.17","2:8.1.2269-1ubuntu5.18","2:8.1.2269-1ubuntu5.20","2:8.1.2269-1ubuntu5.21","2:8.1.2269-1ubuntu5.22","2:8.1.2269-1ubuntu5.23","2:8.1.2269-1ubuntu5.24","2:8.1.2269-1ubuntu5.25","2:8.1.2269-1ubuntu5.26","2:8.1.2269-1ubuntu5.29","2:8.1.2269-1ubuntu5.30","2:8.1.2269-1ubuntu5.31","2:8.1.2269-1ubuntu5.32","2:8.1.2269-1ubuntu5.32+esm2","2:8.1.2269-1ubuntu5.32+esm3","2:8.1.2269-1ubuntu5.32+esm4","2:8.1.2269-1ubuntu5.32+esm5","2:8.1.2269-1ubuntu5.32+esm6","2:8.1.2269-1ubuntu5.32+esm7","2:8.1.2269-1ubuntu5.32+esm8","2:8.1.2269-1ubuntu5.32+esm9","2:8.1.2269-1ubuntu5.32+esm10"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.3995-1ubuntu2.35"}]}],"versions":["2:8.2.2434-3ubuntu3","2:8.2.2434-3ubuntu4","2:8.2.3565-1ubuntu1","2:8.2.3565-1ubuntu2","2:8.2.3565-1ubuntu3","2:8.2.3565-1ubuntu5","2:8.2.3995-1ubuntu1","2:8.2.3995-1ubuntu2","2:8.2.3995-1ubuntu2.1","2:8.2.3995-1ubuntu2.3","2:8.2.3995-1ubuntu2.4","2:8.2.3995-1ubuntu2.5","2:8.2.3995-1ubuntu2.7","2:8.2.3995-1ubuntu2.8","2:8.2.3995-1ubuntu2.9","2:8.2.3995-1ubuntu2.10","2:8.2.3995-1ubuntu2.11","2:8.2.3995-1ubuntu2.12","2:8.2.3995-1ubuntu2.13","2:8.2.3995-1ubuntu2.15","2:8.2.3995-1ubuntu2.16","2:8.2.3995-1ubuntu2.17","2:8.2.3995-1ubuntu2.18","2:8.2.3995-1ubuntu2.19","2:8.2.3995-1ubuntu2.20","2:8.2.3995-1ubuntu2.21","2:8.2.3995-1ubuntu2.22","2:8.2.3995-1ubuntu2.23","2:8.2.3995-1ubuntu2.24","2:8.2.3995-1ubuntu2.26","2:8.2.3995-1ubuntu2.27","2:8.2.3995-1ubuntu2.28","2:8.2.3995-1ubuntu2.29","2:8.2.3995-1ubuntu2.30","2:8.2.3995-1ubuntu2.31","2:8.2.3995-1ubuntu2.32","2:8.2.3995-1ubuntu2.33","2:8.2.3995-1ubuntu2.34"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.0016-1ubuntu7.19"}]}],"versions":["2:9.0.1672-1ubuntu2","2:9.0.2087-1ubuntu1","2:9.0.2116-1ubuntu1","2:9.0.2116-1ubuntu2","2:9.0.2184-0ubuntu1","2:9.0.2189-1ubuntu1","2:9.1.0-1ubuntu1","2:9.1.0016-1ubuntu2","2:9.1.0016-1ubuntu6","2:9.1.0016-1ubuntu7","2:9.1.0016-1ubuntu7.1","2:9.1.0016-1ubuntu7.2","2:9.1.0016-1ubuntu7.3","2:9.1.0016-1ubuntu7.4","2:9.1.0016-1ubuntu7.5","2:9.1.0016-1ubuntu7.6","2:9.1.0016-1ubuntu7.7","2:9.1.0016-1ubuntu7.8","2:9.1.0016-1ubuntu7.9","2:9.1.0016-1ubuntu7.10","2:9.1.0016-1ubuntu7.11","2:9.1.0016-1ubuntu7.12","2:9.1.0016-1ubuntu7.13","2:9.1.0016-1ubuntu7.14","2:9.1.0016-1ubuntu7.15","2:9.1.0016-1ubuntu7.16","2:9.1.0016-1ubuntu7.17","2:9.1.0016-1ubuntu7.18"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.2141-1ubuntu4.8"}]}],"versions":["2:9.1.0967-1ubuntu6","2:9.1.1882-1ubuntu1","2:9.1.1882-1ubuntu2","2:9.1.2141-1ubuntu1","2:9.1.2141-1ubuntu2","2:9.1.2141-1ubuntu4","2:9.1.2141-1ubuntu4.1","2:9.1.2141-1ubuntu4.2","2:9.1.2141-1ubuntu4.3","2:9.1.2141-1ubuntu4.5","2:9.1.2141-1ubuntu4.6","2:9.1.2141-1ubuntu4.7"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0957-160000.1.1"}]}],"bundled":8}],"products":[{"vendor":"vim","product":"vim"}],"references":[{"url":"https://github.com/vim/vim/security/advisories/GHSA-r22p-fhw4-84p2","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/vim/vim/commit/581a2f3ac9c6f96a26324f6b2c8c11415fd0d452","tags":["x_refsource_MISC","Patch","fix","article","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-73076","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66336","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28420","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-52859","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55892","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59857","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73072","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73076","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73077","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73078","tags":["report"]},{"url":"https://bugzilla.redhat.com/2443484","tags":["report"]},{"url":"https://bugzilla.redhat.com/2487989","tags":["report"]},{"url":"https://bugzilla.redhat.com/2492975","tags":["report"]},{"url":"https://bugzilla.redhat.com/2498863","tags":["report"]},{"url":"https://bugzilla.redhat.com/2514034","tags":["report"]},{"url":"https://bugzilla.redhat.com/2514037","tags":["report"]},{"url":"https://bugzilla.redhat.com/2514058","tags":["report"]},{"url":"https://bugzilla.redhat.com/2514065","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-66336.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66348","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-66348.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66366","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-66366.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73076","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-73076","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787649192.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73072","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73078","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1787672129.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1788171117.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1789464361.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1789464719.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1789464785.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1789466646.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1791426968.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1791427864.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1791476847.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1791478209.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73076.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-73076","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0355.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36127","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/24/17","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/24/18","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/24/19","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/24/20","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/24/21","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/24/28","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/24/29","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/24/30","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/24/31","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2","tags":["advisory","article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2","tags":["advisory","article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-hm4g-pjfx-m27j","tags":["advisory"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-49m8-wwxj-mr69","tags":["advisory"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-pmvp-6rcj-98p4","tags":["advisory"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-69ch-22ch-r887","tags":["advisory"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-cx73-phcg-3j5g","tags":["advisory"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64","tags":["advisory","article"]},{"url":"https://www.openwall.com/lists/oss-security/2026/08/25/8","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-r77m-8m55-rpr6","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3593","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73073","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3594","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3595","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3596","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3859","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2443484","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487989","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492975","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498863","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514034","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514037","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514058","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514065","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66336.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28420","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28420","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/bb6de2105b160e729c34063","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0076","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-rvj2-jrf9-2phg","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52859","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52859","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/63680c6d3d52477817b49cd1a66e7aabe8a7aa19","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0565","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-47gw-8gc3-mgcm","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55892","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55892","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/8325b193bba5f01e7a7d8241f","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0662","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-qm9w-fmpj-879h","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59857","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59857","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/d22ff1c955ff87e8273210eae125aab0e85b6c30","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-m3hf-xcm3-xhm2","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73072","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0846","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73076","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73077","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73077","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/c5a82fe013e73c98004ad7cd4f906b1ad1ed610e","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73078","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66348.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66366.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68711","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455542","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461614","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477915","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487964","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487981","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487996","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492972","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492980","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498868","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68711.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34982","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34982","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34982","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/01/1","tags":["article"]},{"url":"https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0276","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-35177","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-35177","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35177","tags":["advisory"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-jc86-w7vm-8p24","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41411","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41411","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41411","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0357","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-46483","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46483","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46483","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0479","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-47162","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47162","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47162","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0495","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-47167","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47167","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47167","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0496","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-52858","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52858","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0561","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55693","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55693","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55693","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0653","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-57455","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57455","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57455","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0698","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-57456","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57456","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57456","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0699","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59858","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59858","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70818","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498867","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70818.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59856","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59856","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59856","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24","tags":["article"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72465","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72465.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72466","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72466.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:66336","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:66348","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:66366","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623190-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1275011","tags":["report"]},{"url":"https://bugzilla.suse.com/1275012","tags":["report"]},{"url":"https://bugzilla.suse.com/1275013","tags":["report"]},{"url":"https://bugzilla.suse.com/1275014","tags":["report"]},{"url":"https://bugzilla.suse.com/1275015","tags":["report"]},{"url":"https://bugzilla.suse.com/1275016","tags":["report"]},{"url":"https://bugzilla.suse.com/1275017","tags":["report"]},{"url":"https://bugzilla.suse.com/1275018","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73078","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623365-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623391-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268162","tags":["report"]},{"url":"https://bugzilla.suse.com/1271684","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623393-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623552-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263677-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263679-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263680-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-73076","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8657-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-28417","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-73071","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-73072","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-73074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-73077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-73078","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-73076","title":"Vim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`","description":"Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.","status":"published","published":"2026-08-11T15:37:59.894Z","modified":"2026-08-11T15:54:03.54Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-94","CWE-829"],"updated_at":"2026-11-02T13:43:33.766176Z"}],"euvd":[{"id":"EUVD-2026-56231","description":"Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.","status":"published","published":"2026-08-11T15:37:59Z","modified":"2026-08-11T15:54:03Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:59.926728Z"}],"nvd":[{"id":"CVE-2026-73076","description":"Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.","status":"published","published":"2026-08-11T16:17:38.98Z","modified":"2026-10-06T19:39:50.817Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-94","CWE-829"],"updated_at":"2026-11-02T14:12:36.499002Z"}],"osv":[{"id":"ALPINE-CVE-2026-73076","description":"Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.","status":"published","published":"2026-08-11T16:17:38.98Z","modified":"2026-11-03T06:33:05.804442366Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"BELL-CVE-2026-73076","status":"published","published":"2026-08-15T06:05:01.898826Z","modified":"2026-10-08T07:15:03.67415739Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:25.777499Z"},{"id":"CVE-2026-73076","title":"Vim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`","description":"Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.","status":"published","published":"2026-08-11T15:37:59.894Z","modified":"2026-10-28T11:17:44.937191064Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-829","CWE-94"],"updated_at":"2026-11-02T15:45:15.88521Z"},{"id":"DEBIAN-CVE-2026-73076","description":"Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.","status":"published","published":"2026-08-11T16:17:38.98Z","modified":"2026-11-01T19:00:43.389238639Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:02.499355Z"},{"id":"OESA-2026-3593","title":"vim security update","description":"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor \u0026amp;apos;Vi\u0026amp;apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.\r\n\r\nSecurity Fix(es):\n\nVim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.(CVE-2026-73072)\n\nVim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.(CVE-2026-73073)\n\nVim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.(CVE-2026-73076)","status":"published","published":"2026-09-05T15:02:58Z","modified":"2026-09-05T15:16:25.23248864Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3594","title":"vim security update","description":"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor \u0026amp;apos;Vi\u0026amp;apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.\r\n\r\nSecurity Fix(es):\n\nVim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.(CVE-2026-73072)\n\nVim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.(CVE-2026-73073)\n\nVim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.(CVE-2026-73076)","status":"published","published":"2026-09-05T15:02:58Z","modified":"2026-09-05T15:16:25.533546041Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3595","title":"vim security update","description":"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor \u0026amp;apos;Vi\u0026amp;apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.\r\n\r\nSecurity Fix(es):\n\nVim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.(CVE-2026-73072)\n\nVim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.(CVE-2026-73073)\n\nVim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.(CVE-2026-73076)","status":"published","published":"2026-09-05T15:02:59Z","modified":"2026-09-05T15:16:25.536489324Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3596","title":"vim security update","description":"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor \u0026amp;apos;Vi\u0026amp;apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.\r\n\r\nSecurity Fix(es):\n\nVim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.(CVE-2026-73072)\n\nVim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.(CVE-2026-73073)\n\nVim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.(CVE-2026-73076)","status":"published","published":"2026-09-05T15:03:00Z","modified":"2026-09-05T15:16:25.730983333Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3859","title":"vim security update","description":"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor \u0026amp;apos;Vi\u0026amp;apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.\r\n\r\nSecurity Fix(es):\n\nVim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.(CVE-2026-73072)\n\nVim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.(CVE-2026-73073)\n\nVim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.(CVE-2026-73076)","status":"published","published":"2026-09-14T16:35:04Z","modified":"2026-09-13T16:45:50.798748721Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2026:66336","title":"Red Hat Security Advisory: vim security update","status":"published","published":"2026-09-10T10:17:17Z","modified":"2026-10-14T10:26:55Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:66348","title":"Red Hat Security Advisory: vim security update","status":"published","published":"2026-09-11T10:15:05Z","modified":"2026-10-14T10:26:55Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:66366","title":"Red Hat Security Advisory: vim security update","status":"published","published":"2026-09-11T10:15:07Z","modified":"2026-10-14T10:26:58Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68711","title":"Red Hat Security Advisory: vim security update","status":"published","published":"2026-09-18T10:15:36Z","modified":"2026-10-14T10:28:05Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:70818","title":"Red Hat Security Advisory: vim security update","status":"published","published":"2026-09-24T10:15:09Z","modified":"2026-10-14T10:28:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:72465","title":"Red Hat Security Advisory: vim security update","status":"published","published":"2026-09-29T10:18:22Z","modified":"2026-10-14T10:29:23Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:72466","title":"Red Hat Security Advisory: vim security update","status":"published","published":"2026-09-29T10:18:22Z","modified":"2026-10-14T10:29:24Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RLSA-2026:66336","title":"Important: vim security update","description":"Vim (Vi IMproved) is an updated and improved version of the vi editor.\n\nSecurity Fix(es):\n\n* vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420)\n\n* vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859)\n\n* vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892)\n\n* vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857)\n\n* vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)\n\n* vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)\n\n* vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)\n\n* vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-11T12:09:43.14217Z","modified":"2026-09-11T12:30:02.639442899Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:66348","title":"Important: vim security update","description":"Vim (Vi IMproved) is an updated and improved version of the vi editor.\n\nSecurity Fix(es):\n\n* vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420)\n\n* vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859)\n\n* vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892)\n\n* vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857)\n\n* vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)\n\n* vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)\n\n* vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-11T06:01:11.299759Z","modified":"2026-09-11T06:30:02.591342236Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:66366","title":"Important: vim security update","description":"Vim (Vi IMproved) is an updated and improved version of the vi editor.\n\nSecurity Fix(es):\n\n* vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420)\n\n* vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859)\n\n* vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892)\n\n* vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857)\n\n* vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)\n\n* vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)\n\n* vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)\n\n* vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-11T12:05:26.835797Z","modified":"2026-09-11T12:30:02.63182704Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-73076","description":"Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.","status":"published","published":"2026-08-11T16:17:00Z","modified":"2026-10-08T12:54:45.360679428Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:08.628462Z"},{"id":"ALSA-2026:66336","title":"Important: vim security update","description":"Vim (Vi IMproved) is an updated and improved version of the vi editor.  \n\nSecurity Fix(es):  \n\n  * vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420)\n  * vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859)\n  * vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892)\n  * vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857)\n  * vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)\n  * vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)\n  * vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)\n  * vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-10T00:00:00Z","modified":"2026-10-29T11:30:42.311346003Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:66348","title":"Important: vim security update","description":"Vim (Vi IMproved) is an updated and improved version of the vi editor.  \n\nSecurity Fix(es):  \n\n  * vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420)\n  * vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859)\n  * vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892)\n  * vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857)\n  * vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)\n  * vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)\n  * vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-10T00:00:00Z","modified":"2026-10-29T11:02:29.339868006Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:66366","title":"Important: vim security update","description":"Vim (Vi IMproved) is an updated and improved version of the vi editor.  \n\nSecurity Fix(es):  \n\n  * vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420)\n  * vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859)\n  * vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892)\n  * vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857)\n  * vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)\n  * vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)\n  * vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)\n  * vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-10T00:00:00Z","modified":"2026-10-29T11:31:33.453381572Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-95562","title":"CVE-2026-73076 affecting package vim for versions less than 9.2.0957-1","description":"Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.","status":"published","published":"2026-08-11T16:17:38Z","modified":"2026-09-10T14:16:59.152603811Z","updated_at":"2026-11-02T15:28:12.028669Z"},{"id":"CLSA-2026-1787649192","title":"Fix CVE(s): CVE-2026-73072, CVE-2026-73076, CVE-2026-73078","description":"   * SECURITY UPDATE: Heap buffer overflow in set_sofo() in src/spellfile.c: a crafted spell file with an SN_SAL section before an SN_SOFO section leaves sl_sal_first[] entries at -1, so the counting loop under-counts multi-byte mapping lists and later writes run past the end of an undersized heap allocation\n     - debian/patches/CVE-2026-73072.patch: reset sl_sal_first[] with vim_memset() at the top of the SN_SOFO counting loop in set_sofo(), as done upstream in patch 9.2.0846, so entries left at -1 by a preceding set_sal_first() can no longer skew the item counts\n     - CVE-2026-73072\n   * SECURITY UPDATE: Code execution via a crafted vimball archive: a member named .VimballRecord overwrites the un-vimball bookkeeping file with attacker-chosen Ex commands that are later :executed verbatim by vimball#RmVimball(), allowing arbitrary OS command execution through :!\n     - debian/patches/CVE-2026-73076.patch: forbid extracting a vimball member named .VimballRecord, record file deletions with string() quoting, and make vimball#RmVimball() execute only whitelisted call delete('...') entries instead of the whole record line (upstream patch 9.2.0847 adapted to vimball v37)\n     - CVE-2026-73076\n   * SECURITY UPDATE: Code injection in netrw bookmark, history and target menus: paths are interpolated into :execute'd :menu commands escaped with g:netrw_menu_escape, which lacks the Ex separator '|', so a crafted directory path breaks out of the :menu command and runs arbitrary Ex/shell commands\n     - debian/patches/CVE-2026-73078.patch: add '|' to g:netrw_menu_escape, escape the :e menu targets with escape(fnameescape(...),'|') in s:NetrwBookmarkMenu(), and quote the netrw#MakeTgt() arguments with string() in s:NetrwTgtMenu() (upstream patch 9.2.0840 adapted to netrw v156)\n     - CVE-2026-73078","status":"published","published":"2026-08-25T09:13:25Z","modified":"2026-10-26T09:31:34.051787053Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787672129","title":"Fix CVE(s): CVE-2026-73072, CVE-2026-73076, CVE-2026-73078","description":"   * SECURITY UPDATE: Heap buffer overflow in set_sofo() in src/spell.c: a crafted spell file with an SN_SAL section before an SN_SOFO section leaves sl_sal_first[] entries at -1, so the counting loop under-counts multi-byte mapping lists and later writes run past the end of an undersized heap allocation\n     - debian/patches/CVE-2026-73072.patch: reset sl_sal_first[] with vim_memset() at the top of the SN_SOFO counting loop in set_sofo() in src/spell.c, as done upstream in patch 9.2.0846, so entries left at -1 by a preceding set_sal_first() can no longer skew the item counts\n     - CVE-2026-73072\n   * SECURITY UPDATE: Code execution via a crafted vimball archive: a member named .VimballRecord overwrites the un-vimball bookkeeping file with attacker-chosen Ex commands that are later :executed verbatim by vimball#RmVimball(), allowing arbitrary OS command execution through :!\n     - debian/patches/CVE-2026-73076.patch: forbid extracting a vimball member named .VimballRecord, record file deletions with string() quoting, and make vimball#RmVimball() execute only whitelisted call delete('...') entries instead of the whole record line (upstream patch 9.2.0847 adapted to vimball v35)\n     - CVE-2026-73076\n   * SECURITY UPDATE: Code injection in netrw bookmark, history and target menus: paths are interpolated into :execute'd :menu commands escaped with g:netrw_menu_escape, which lacks the Ex separator '|', so a crafted directory path breaks out of the :menu command and runs arbitrary Ex/shell commands\n     - debian/patches/CVE-2026-73078.patch: add '|' to g:netrw_menu_escape, escape the :e menu targets with escape(fnameescape(...),'|') in s:NetrwBookmarkMenu(), and quote the netrw#MakeTgt() arguments with string() in s:NetrwTgtMenu() (upstream patch 9.2.0840 adapted to netrw v155)\n     - CVE-2026-73078","status":"published","published":"2026-08-25T15:35:41Z","modified":"2026-10-26T09:32:02.171418611Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788171117","title":"Fix CVE(s): CVE-2026-73072, CVE-2026-73076, CVE-2026-73078","description":"   * SECURITY UPDATE: Heap buffer overflow in set_sofo() in src/spellfile.c: a crafted spell file with an SN_SAL section before an SN_SOFO section leaves sl_sal_first[] entries at -1, so the counting loop under-counts multi-byte mapping lists and later writes run past the end of an undersized heap allocation\n     - debian/patches/CVE-2026-73072.patch: reset sl_sal_first[] with vim_memset() at the top of the SN_SOFO counting loop in set_sofo(), as done upstream in patch 9.2.0846, so entries left at -1 by a preceding set_sal_first() can no longer skew the item counts\n     - CVE-2026-73072\n   * SECURITY UPDATE: Code execution via a crafted vimball archive: a member named .VimballRecord overwrites the un-vimball bookkeeping file with attacker-chosen Ex commands that are later :executed verbatim by vimball#RmVimball(), allowing arbitrary OS command execution through :!\n     - debian/patches/CVE-2026-73076.patch: forbid extracting a vimball member named .VimballRecord, record file deletions with string() quoting, and make vimball#RmVimball() execute only whitelisted call delete('...') entries instead of the whole record line (upstream patch 9.2.0847 adapted to vimball v37)\n     - CVE-2026-73076\n   * SECURITY UPDATE: Code injection in netrw bookmark, history and target menus: paths are interpolated into :execute'd :menu commands escaped with g:netrw_menu_escape, which lacks the Ex separator '|', so a crafted directory path breaks out of the :menu command and runs arbitrary Ex/shell commands\n     - debian/patches/CVE-2026-73078.patch: add '|' to g:netrw_menu_escape, escape the :e menu targets with escape(fnameescape(...),'|') in s:NetrwBookmarkMenu(), and quote the netrw#MakeTgt() arguments with string() in s:NetrwTgtMenu() (upstream patch 9.2.0840 adapted to netrw v156)\n     - CVE-2026-73078","status":"published","published":"2026-08-31T10:12:09Z","modified":"2026-10-26T09:31:53.125401821Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1789464361","title":"vim: Fix of 3 CVEs","description":"- CVE-2026-73072: fix heap buffer overflow in set_sofo(); reset sl_sal_first[] before the SN_SOFO\n  counting loop, since a preceding SN_SAL section may have set its entries to -1 via set_sal_first(),\n  making the loop under-count colliding multi-byte characters and allocate an undersized list\n  (src/spellfile.c, upstream patch 9.2.0846)\n- CVE-2026-73076: fix arbitrary code execution via a crafted .VimballRecord file; refuse to extract\n  a member named .VimballRecord, record deletions with string() instead of raw quote interpolation,\n  and execute only whitelisted call delete() entries in vimball#RmVimball()\n  (runtime/autoload/vimball.vim, upstream patch 9.2.0847)\n- CVE-2026-73078: fix Ex command injection in the netrw bookmark and history menus; add the Ex\n  separator | to g:netrw_menu_escape, escape the :e targets with fnameescape(), and quote the\n  netrw#MakeTgt() arguments with string() (runtime/autoload/netrw.vim, upstream patch 9.2.0840)","status":"published","published":"2026-09-15T09:26:12Z","modified":"2026-10-26T09:31:50.512867333Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789464719","title":"vim: Fix of 3 CVEs","description":"- CVE-2026-73072: fix heap buffer overflow in set_sofo(); reset sl_sal_first[] before the SN_SOFO\n  counting loop, since a preceding SN_SAL section may have set its entries to -1 via set_sal_first(),\n  making the loop under-count colliding multi-byte characters and allocate an undersized list\n  (src/spellfile.c, upstream patch 9.2.0846)\n- CVE-2026-73076: fix arbitrary code execution via a crafted .VimballRecord file; refuse to extract\n  a member named .VimballRecord, record deletions with string() instead of raw quote interpolation,\n  and execute only whitelisted call delete() entries in vimball#RmVimball()\n  (runtime/autoload/vimball.vim, upstream patch 9.2.0847)\n- CVE-2026-73078: fix Ex command injection in the netrw bookmark and history menus; add the Ex\n  separator | to g:netrw_menu_escape, escape the :e targets with fnameescape(), and quote the\n  netrw#MakeTgt() arguments with string() (runtime/autoload/netrw.vim, upstream patch 9.2.0840)","status":"published","published":"2026-09-15T09:32:11Z","modified":"2026-10-26T09:31:51.518297152Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789464785","title":"vim: Fix of 3 CVEs","description":"- CVE-2026-73072: fix heap buffer overflow in set_sofo(); reset sl_sal_first[] before the SN_SOFO\n  counting loop, since a preceding SN_SAL section may have set its entries to -1 via set_sal_first(),\n  making the loop under-count colliding multi-byte characters and allocate an undersized list\n  (src/spellfile.c, upstream patch 9.2.0846)\n- CVE-2026-73076: fix arbitrary code execution via a crafted .VimballRecord file; refuse to extract\n  a member named .VimballRecord, record deletions with string() instead of raw quote interpolation,\n  and execute only whitelisted call delete() entries in vimball#RmVimball()\n  (runtime/autoload/vimball.vim, upstream patch 9.2.0847)\n- CVE-2026-73078: fix Ex command injection in the netrw bookmark and history menus; add the Ex\n  separator | to g:netrw_menu_escape, escape the :e targets with fnameescape(), and quote the\n  netrw#MakeTgt() arguments with string() (runtime/autoload/netrw.vim, upstream patch 9.2.0840)","status":"published","published":"2026-09-15T09:33:17Z","modified":"2026-10-26T09:30:54.906455193Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789466646","title":"vim: Fix of 3 CVEs","description":"- CVE-2026-73072: reset sl_sal_first[] in set_sofo() so a spell file with an SN_SAL section before an SN_SOFO section cannot under-count the mapping lists and write past the allocation\n- CVE-2026-73076: forbid a .VimballRecord member filename and only execute well-formed delete commands when removing a vimball\n- CVE-2026-73078: escape the Ex command separator when netrw builds the Bookmarks, History and Targets menus","status":"published","published":"2026-09-15T10:04:19Z","modified":"2026-10-26T09:31:32.873451778Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1791426968","title":"vim: Fix of 3 CVEs","description":"- CVE-2026-73072: fix heap buffer overflow in set_sofo() with a crafted spell file (upstream 9.2.0846)\n- CVE-2026-73076: fix arbitrary command execution via a crafted .VimballRecord vimball member (upstream 9.2.0847)\n- CVE-2026-73078: fix Ex command injection via crafted netrw bookmark/history menu entries (upstream 9.2.0840)","status":"published","published":"2026-10-08T09:25:48Z","modified":"2026-10-26T09:31:55.005843103Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791427864","title":"vim: Fix of 3 CVEs","description":"- CVE-2026-73072: fix heap buffer overflow in set_sofo() with a crafted spell file (upstream 9.2.0846)\n- CVE-2026-73076: fix arbitrary command execution via a crafted .VimballRecord vimball member (upstream 9.2.0847)\n- CVE-2026-73078: fix Ex command injection via crafted netrw bookmark/history menu entries (upstream 9.2.0840)","status":"published","published":"2026-10-08T22:06:26Z","modified":"2026-10-26T09:31:40.79719894Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791476847","title":"vim: Fix of CVE-2026-73076","description":"- CVE-2026-73076: fix code execution via a poisoned .VimballRecord file - refuse\n  a vimball member named .VimballRecord and replay only call delete() entries on\n  :RmVimball (upstream 9.2.0847)","status":"published","published":"2026-10-08T23:16:22Z","modified":"2026-10-26T09:31:56.864345797Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791478209","title":"vim: Fix of CVE-2026-73076","description":"- CVE-2026-73076: fix code execution via a poisoned .VimballRecord file - refuse\n  a vimball member named .VimballRecord and replay only call delete() entries on\n  :RmVimball (upstream 9.2.0847)","status":"published","published":"2026-10-09T14:55:49Z","modified":"2026-10-26T09:31:49.361216597Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"MGASA-2026-0355","title":"Updated vim packages fix security vulnerabilities","description":"Arbitrary Code Execution via Shell Keyword Lookup in Vim \u003c 9.2.0839.\n(CVE-2026-73077)\nArbitrary Code Execution via Netrw Menu Construction in Vim \u003c 9.2.0840.\n(CVE-2026-73078)\nHeap Buffer Overflow in Text Property Handling in Vim \u003c 9.2.0841.\n(CVE-2026-73074)\nStack Buffer Overflow in the Vim Socket Server in Vim \u003c 9.2.0842.\n(CVE-2026-73070)\nOut-of-bounds Access in Popup Opacity Handling in Vim \u003e= 9.2.0469 \u0026\u0026 Vim\n\u003c 9.2.0843. (CVE-2026-73075)\nUse-after-free in JSON Decoding in Vim \u003e= 9.2.0511 \u0026\u0026 Vim \u003c 9.2.0844.\n(CVE-2026-73071)\nArbitrary Ex Command Execution in C Omni-Completion in Vim \u003c 9.2.0845.\n(CVE-2026-73073)\nHeap Buffer Overflow when Loading a Spell File in Vim \u003c 9.2.0846.\n(CVE-2026-73072)\nArbitrary Command Execution via Malicious `.VimballRecord` Entry Replay\nin `vimball.vim`. (CVE-2026-73076)\n","status":"published","published":"2026-09-01T03:06:53Z","modified":"2026-09-01T03:26:20.493146665Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:21671-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\nUpdated to version 9.2.0957.\n\nSecurity issues fixed:\n\n- CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).\n- CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).\n- CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution\n  (bsc#1275016).\n- CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution\n  (bsc#1275015).\n- CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).\n- CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).\n- CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).\n- CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).\n\nOther updates and bugfixes:\n\n- Version 9.2.0957.\n  * tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).\n  * tests: missing cleanup in test_mksession.vim (9.2.0782).\n  * tests: personal spell files leak into later tests (9.2.0783).\n  * crash when borrowing statusline highlight in silent Ex mode (9.2.0784).\n  * WinResized not triggered when the whole Vim is resized (9.2.0785).\n  * filetype: containerfile is not recognized (9.2.0786).\n  * regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).\n  * filetype: hip files are not recognized (9.2.0788).\n  * 'statuslineopt' status line too high after a window is minimized (9.2.0789).\n  * 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).\n  * wincol() counts from right side for 'rightleft' (9.2.0791).\n  * runtime(netrw): explore without optional dir broken (9.2.0792).\n  * if session restored a tiny window, restore fails (9.2.0793).\n  * extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).\n  * popup menu shadow is not cleared when the menu shrinks (9.2.0795).\n  * Visual block reselection wrong with 'virtualedit' (9.2.0796).\n  * memory leak in get_qfline_items() on alloc failure (9.2.0797).\n  * memory leak in compile_expr6() on alloc failure (9.2.0798).\n  * memory leak in compile_def_function_body() on alloc failure (9.2.0799).\n  * memory leak in call_func() on alloc failure (9.2.0800).\n  * memory leak in f_getreginfo() on alloc failure (9.2.0801).\n  * memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).\n  * memory leak on alloc failure with taglist/gettagstack() (9.2.0803).\n  * wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).\n  * screenpos() \"curscol\" is wrong with 'rightleft' (9.2.0805).\n  * 'showcmd' may show internal command keys (9.2.0806).\n  * MS-Windows: ellipsis character is garbled (9.2.0807).\n  * getregionpos: double-free on alloc failure (9.2.0808).\n  * getframelayout() uses wrong function to free lists (9.2.0809).\n  * add_llist_tags() uses wrong function to free dict (9.2.0810).\n  * mksession writes terminal command unquoted (9.2.0811).\n  * :argdelete with pattern leads to wrong argidx() (9.2.0812).\n  * dict_add_func() may corrupt funcref count on failure (9.2.0813).\n  * Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).\n  * deeply nested regexp patterns may cause stack overflow (9.2.0815).\n  * GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).\n  * crash when building a stacktrace during an autocommand (9.2.0817).\n  * tests: client-server test fails without X11 server (9.2.0818).\n  * MS-Windows: sixel image shown as raw text in the console (9.2.0819).\n  * GUI: hidden popup image is displayed and not erased (9.2.0820).\n  * filetype: msmtp system-wide rc file not detected (9.2.0821).\n  * GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).\n  * tests: Test_clientserver_servlist_list may fail (9.2.0823).\n  * Makefile: make tags depends on configure (9.2.0824).\n  * regexp: submatch in a look-behind is empty with the NFA engine (9.2.0825).\n  * highlighting for broken terminals can be improved (9.2.0826).\n  * :startinsert enters Insert mode in a non-modifiable buffer (9.2.0827).\n  * GTK4: hardware rendering can be improved (9.2.0828).\n  * sessions do not preserve script version for expression options (9.2.0829).\n  * the completion menu is not used on terminals without colors (9.2.0830).\n  * diff highlighting hard to read with syntax enabled (9.2.0831).\n  * socketserver: remote commands can be processed in reverse order (9.2.0832).\n  * GTK4: menu mnemonics do not work properly (9.2.0833).\n  * cleared last search pattern is restored from viminfo (9.2.0834).\n  * features in version.c are not sorted (9.2.0835).\n  * filetype: .git-blame-ignore-revs file is not recognized (9.2.0836).\n  * using wrong colors in hl_blend_attr() (9.2.0837).\n  * searchcount() returns wrong cached maxcount (9.2.0838).\n  * [security]: arbitrary code execution via keyword lookup (9.2.0839).\n  * [security]: code injection in netrw via bookmarks (9.2.0840).\n  * [security]: heap overflow when adding \u003e 65535 text properties (9.2.0841).\n  * [security]: stack buffer overflow in socket server (9.2.0842).\n  * [security]: popup: opacity mask indexed out of bounds (9.2.0843).\n  * [security]: use-after-free on json decode error (9.2.0844).\n  * [security]: arbitrary Ex command execution during C omni-completion (9.2.0845).\n  * [security]: heap buffer overflow in set_sofo() (9.2.0846).\n  * [security]: vimball: code execution via .VimballRecord file (9.2.0847).\n  * tagfunc \"cmd\" with a generic Ex command corrupts the tag entry (9.2.0848).\n  * filetype: osquery config files are not recognized (9.2.0849).\n  * MS-Windows: commands from a client can be lost (9.2.0850).\n  * focus autocommands triggered inconsistently (9.2.0851).\n  * GTK: ligatures not correctly displayed (9.2.0852).\n  * popup: popup images do not support scaling (9.2.0853).\n  * memory leak when reading a spell file with SN_SAL and SN_SOFO (9.2.0854).\n  * 'showcmd' not redrawn with empty mapping triggered on timeout (9.2.0855).\n  * GTK4: undercurl rendering is inefficient (9.2.0856).\n  * popup: opacity popup over a terminal is not cleared when closed (9.2.0857).\n  * MS-Windows GUI: white flash when VimEnter is slow (9.2.0858).\n  * GTK2: link error (9.2.0859).\n  * filetype: xilinx design constraint files are not recognized (9.2.0860).\n  * GTK4: bleed region updates in jumps (9.2.0861).\n  * missing test change from v9.2.0857 (9.2.0862).\n  * MS-Windows GUI: window contents can be missing when VimEnter is slow (9.2.0863).\n  * using some dead code in Wayland feature (9.2.0864).\n  * GTK4: non-hardware accelerated UI is too slow (9.2.0865).\n  * MS-Windows: \":language messages\" only works once (9.2.0866).\n  * MS-Windows: messages are not in the display language (9.2.0867).\n  * GTK: window Manager hint prevents giving focus to dialog (9.2.0868).\n  * buf_copy_options() can lose the P_INSECURE flag (9.2.0869).\n  * filetype: marko files are not recognized (9.2.0870).\n  * screen line is lost when splitting a 'winfixheight' window (9.2.0871).\n  * popup with opacity does not use the font of the highlight group (9.2.0872).\n  * :redrawstatus does not update the ruler of the last window (9.2.0873).\n  * fold size is compared against 'foldminlines' of the wrong window (9.2.0874).\n  * GTK4: GUI does not support command-line arguments (9.2.0875).\n  * GTK4: compile error with disabled netbeans feat (9.2.0876).\n  * Vim9: crash when a closure assigns to a variable declared in a loop (9.2.0877).\n  * Vim9: cannot use a script variable of an enclosing block in a lambda (9.2.0878).\n  * popup: \"maxwidth\" is not respected when 'wrap' is off (9.2.0879).\n  * scroll: window scrolls when using the autocommand window (9.2.0880).\n  * 'smoothscroll' position is lost when the window height changes (9.2.0881).\n  * :bwipe crashes if WinLeave wipes all other buffers (9.2.0882).\n  * scroll: 'smoothscroll' position is lost when using \"|\" (9.2.0883).\n  * scroll: unreachable 'smoothscroll' code in cursor_correct() (9.2.0884).\n  * scroll: 'smoothscroll' position is lost when the window is squeezed (9.2.0885).\n  * :set completion works for an invalid sub-option name (9.2.0886).\n  * scroll: jump-scrolling when moving the cursor onto a wrapping line (9.2.0887).\n  * mapping: modifier is not recognized after a partial mapping (9.2.0888).\n  * VMS: spurious \"INVALID DECC FEATURE VALUE\" message at every startup (9.2.0889).\n  * test: test for patch v9.2.0888 can be clarified (9.2.0890).\n  * MS-Windows: filename-modifier \":8:t\" causes underflow (9.2.0891).\n  * highlight: wrong column highlighted with 'cursorcolumn' (9.2.0892).\n  * MS-Windows: \"*.vim\" also matches files with a longer extension (9.2.0893).\n  * filetype: ed script files not recognised (9.2.0894).\n  * test: Test_aucmd_win_scroll_multibyte() is flaky in the GUI (9.2.0895).\n  * scroll: 'smoothscroll' position is lost when splitting a window (9.2.0896).\n  * GTK3 X11 redraws are not coalesced (9.2.0897).\n  * printing support is lacking (9.2.0898).\n  * command output temporary files may collide (9.2.0899).\n  * FocusGained still triggered when closing dialog (9.2.0900).\n  * textprop: wrong cursor line with truncated virtual text (9.2.0901).\n  * Vim9: iterating over a tuple leaks memory (9.2.0902).\n  * Vim9: cannot use an exported function of an autoload import (9.2.0903).\n  * \"zb\" scrolls incorrectly with cursor just above fold (9.2.0904).\n  * MS-Windows: ghost cursor with ligatures (9.2.0905).\n  * slow transstr() with long strings (9.2.0906).\n  * popup: virtual text is not redrawn when a text property changes (9.2.0907).\n  * cannot use a {} block in a nested :autocmd (9.2.0908).\n  * insert completion is slow to collect many matches (9.2.0909).\n  * runtime(vim): update syntax, contain Ex commands (9.2.0910).\n  * makefiles do not build hardcopy_postscript.c (9.2.0911).\n  * hardcopy: prototypes are hand-written instead of generated (9.2.0912).\n  * statusline: cell below the vertical separator keeps the old highlight (9.2.0913).\n  * diff: undo after :diffget into an empty buffer leaves a line behind (9.2.0914).\n  * tests: two terminal tests in test_popupwin fail on FreeBSD (9.2.0915).\n  * configure: honor `--disable-hardcopy-pango` with GTK UI (9.2.0916).\n  * :quitall not allowed in the command-line window (9.2.0917).\n  * screen: fill char with a zero low byte is stored as a NUL cell (9.2.0918).\n  * screen: the wrong array is copied into ScreenCols on a resize (9.2.0919).\n  * filetype: json-ld files are not recognized (9.2.0920).\n  * test: terminal tests fail on FreeBSD (9.2.0921).\n  * Wayland: modeless selection not redrawn (9.2.0922).\n  * tabpage: closing a tab page loses the alternate tab page (9.2.0923).\n  * tests: Test_termwinscroll() fails on FreeBSD (9.2.0924).\n  * crash when getcompletiontype() gets a NULL string (9.2.0925).\n  * filetype: business Central files are not recognized (9.2.0926).\n  * curswant not set on 8g8 (9.2.0927).\n  * MinGW: tests hang when Vim is built with coverage enabled (9.2.0928).\n  * incorrect completion for 'pumopt' and 'pumborder' (9.2.0929).\n  * floating point exception when displaying pum (9.2.0930).\n  * the GTK4 GUI is still experimental and untested by CI (9.2.0931).\n  * NFA engine fallback can double free the compiled program (9.2.0932).\n  * u_read_undo() leaks the file name when the undo file owner differs (9.2.0933).\n  * filetype: hlsl files are not recognized (9.2.0934).\n  * reading an undo file is slow with many undo headers (9.2.0935).\n  * stringifying a list or dict can free the item being iterated (9.2.0936).\n  * sort() with a numeric option converts each item on every comparison (9.2.0937).\n  * cursorbind: cursor in the other window is not updated after undo (9.2.0938).\n  * mbyte: wrong cell count for an overlong UTF-8 sequence (9.2.0939).\n  * GTK4: columns are lost when a scrollbar appears (9.2.0940).\n  * tests: clipboard tests fail in the GUI when the terminal has no clipboard (9.2.0941).\n  * test: test_mksession_winpos() fails on GTK4 UI (9.2.0942).\n  * test: test_hardcopy fails on GTK4 UI (9.2.0943).\n  * test: tests fail when checking for GTK4 feature (9.2.0944).\n  * sort() with a numeric option can be improved (9.2.0945).\n  * GTK2/3: mouse move starts Visual selection after a dialog (9.2.0946).\n  * GTK4: screen is cleared when moving the mouse after startup (9.2.0947).\n  * GTK4: mouse move starts Visual selection after a dialog (9.2.0948).\n  * GDK_KEY_VoidSymbol might be undefined (9.2.0949).\n  * transstr() can be improved (after 9.2.0906) (9.2.0950).\n  * GTK3: cursor does no longer blink (9.2.0951).\n  * locking a container while stringifying can be improved (9.2.0952).\n  * insert completion code can be improved (9.2.0953).\n  * u_read_undo() can be improved (after 9.2.0935) (9.2.0954).\n  * tests: terminal tests are flaky (9.2.0955).\n  * GTK4: crash when the window is resized while redrawing (9.2.0956).\n  * filetype: ArgoCD config file is not recognized (9.2.0957).\n- Allow `wrap` and `linebreak` to be set from a modeline (bsc#1268162).\n- Point `SYS_VIMRC_FILE` at `$VIMRUNTIME/suse.vimrc` rather than `/etc/vimrc`, which we no longer own (bsc#1268162).\n- Update `suse.vimrc`: source `/etc/vimrc` at the end of the file, so that a local system vimrc still overrides the\n  distribution defaults.\n- Guard `suse.vimrc` against re-entry to prevent an infinite sourcing loop (bsc#1271684).\n","status":"published","published":"2026-08-28T08:29:47Z","modified":"2026-08-30T13:00:03.967186744Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-73076","title":"CVE-2026-73076 in vim - Patched by Root","description":"Root has patched CVE-2026-73076 in the vim package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-31T08:18:29Z","modified":"2026-08-31T09:15:06.89787053Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-73076","title":"CVE-2026-73076 in vim - Patched by Root","description":"Root has patched CVE-2026-73076 in the vim package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-26T07:45:37Z","modified":"2026-08-26T09:00:05.575658489Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"SUSE-SU-2026:23190-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\nUpdated to version 9.2.0957.\n\n- CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).\n- CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).\n- CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution\n  (bsc#1275016).\n- CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution\n  (bsc#1275015).\n- CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).\n- CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).\n- CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).\n- CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).\n\nChanges for vim:\n\n- Version 9.2.0957:\n  * tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).\n  * tests: missing cleanup in test_mksession.vim (9.2.0782).\n  * tests: personal spell files leak into later tests (9.2.0783).\n  * crash when borrowing statusline highlight in silent Ex mode (9.2.0784).\n  * WinResized not triggered when the whole Vim is resized (9.2.0785).\n  * filetype: containerfile is not recognized (9.2.0786).\n  * regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).\n  * filetype: hip files are not recognized (9.2.0788).\n  * 'statuslineopt' status line too high after a window is minimized (9.2.0789).\n  * 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).\n  * wincol() counts from right side for 'rightleft' (9.2.0791).\n  * runtime(netrw): explore without optional dir broken (9.2.0792).\n  * if session restored a tiny window, restore fails (9.2.0793).\n  * extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).\n  * popup menu shadow is not cleared when the menu shrinks (9.2.0795).\n  * Visual block reselection wrong with 'virtualedit' (9.2.0796).\n  * memory leak in get_qfline_items() on alloc failure (9.2.0797).\n  * memory leak in compile_expr6() on alloc failure (9.2.0798).\n  * memory leak in compile_def_function_body() on alloc failure (9.2.0799).\n  * memory leak in call_func() on alloc failure (9.2.0800).\n  * memory leak in f_getreginfo() on alloc failure (9.2.0801).\n  * memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).\n  * memory leak on alloc failure with taglist/gettagstack() (9.2.0803).\n  * wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).\n  * screenpos() \"curscol\" is wrong with 'rightleft' (9.2.0805).\n  * 'showcmd' may show internal command keys (9.2.0806).\n  * MS-Windows: ellipsis character is garbled (9.2.0807).\n  * getregionpos: double-free on alloc failure (9.2.0808).\n  * getframelayout() uses wrong function to free lists (9.2.0809).\n  * add_llist_tags() uses wrong function to free dict (9.2.0810).\n  * mksession writes terminal command unquoted (9.2.0811).\n  * :argdelete with pattern leads to wrong argidx() (9.2.0812).\n  * dict_add_func() may corrupt funcref count on failure (9.2.0813).\n  * Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).\n  * deeply nested regexp patterns may cause stack overflow (9.2.0815).\n  * GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).\n  * crash when building a stacktrace during an autocommand (9.2.0817).\n  * tests: client-server test fails without X11 server (9.2.0818).\n  * MS-Windows: sixel image shown as raw text in the console (9.2.0819).\n  * GUI: hidden popup image is displayed and not erased (9.2.0820).\n  * filetype: msmtp system-wide rc file not detected (9.2.0821).\n  * GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).\n  * tests: Test_clientserver_servlist_list may fail (9.2.0823).\n  * Makefile: make tags depends on configure (9.2.0824).\n  * regexp: submatch in a look-behind is empty with the NFA engine (9.2.0825).\n  * highlighting for broken terminals can be improved (9.2.0826).\n  * :startinsert enters Insert mode in a non-modifiable buffer (9.2.0827).\n  * GTK4: hardware rendering can be improved (9.2.0828).\n  * sessions do not preserve script version for expression options (9.2.0829).\n  * the completion menu is not used on terminals without colors (9.2.0830).\n  * diff highlighting hard to read with syntax enabled (9.2.0831).\n  * socketserver: remote commands can be processed in reverse order (9.2.0832).\n  * GTK4: menu mnemonics do not work properly (9.2.0833).\n  * cleared last search pattern is restored from viminfo (9.2.0834).\n  * features in version.c are not sorted (9.2.0835).\n  * filetype: .git-blame-ignore-revs file is not recognized (9.2.0836).\n  * using wrong colors in hl_blend_attr() (9.2.0837).\n  * searchcount() returns wrong cached maxcount (9.2.0838).\n  * [security]: arbitrary code execution via keyword lookup (9.2.0839).\n  * [security]: code injection in netrw via bookmarks (9.2.0840).\n  * [security]: heap overflow when adding \u003e 65535 text properties (9.2.0841).\n  * [security]: stack buffer overflow in socket server (9.2.0842).\n  * [security]: popup: opacity mask indexed out of bounds (9.2.0843).\n  * [security]: use-after-free on json decode error (9.2.0844).\n  * [security]: arbitrary Ex command execution during C omni-completion (9.2.0845).\n  * [security]: heap buffer overflow in set_sofo() (9.2.0846).\n  * [security]: vimball: code execution via .VimballRecord file (9.2.0847).\n  * tagfunc \"cmd\" with a generic Ex command corrupts the tag entry (9.2.0848).\n  * filetype: osquery config files are not recognized (9.2.0849).\n  * MS-Windows: commands from a client can be lost (9.2.0850).\n  * focus autocommands triggered inconsistently (9.2.0851).\n  * GTK: ligatures not correctly displayed (9.2.0852).\n  * popup: popup images do not support scaling (9.2.0853).\n  * memory leak when reading a spell file with SN_SAL and SN_SOFO (9.2.0854).\n  * 'showcmd' not redrawn with empty mapping triggered on timeout (9.2.0855).\n  * GTK4: undercurl rendering is inefficient (9.2.0856).\n  * popup: opacity popup over a terminal is not cleared when closed (9.2.0857).\n  * MS-Windows GUI: white flash when VimEnter is slow (9.2.0858).\n  * GTK2: link error (9.2.0859).\n  * filetype: xilinx design constraint files are not recognized (9.2.0860).\n  * GTK4: bleed region updates in jumps (9.2.0861).\n  * missing test change from v9.2.0857 (9.2.0862).\n  * MS-Windows GUI: window contents can be missing when VimEnter is slow (9.2.0863).\n  * using some dead code in Wayland feature (9.2.0864).\n  * GTK4: non-hardware accelerated UI is too slow (9.2.0865).\n  * MS-Windows: \":language messages\" only works once (9.2.0866).\n  * MS-Windows: messages are not in the display language (9.2.0867).\n  * GTK: window Manager hint prevents giving focus to dialog (9.2.0868).\n  * buf_copy_options() can lose the P_INSECURE flag (9.2.0869).\n  * filetype: marko files are not recognized (9.2.0870).\n  * screen line is lost when splitting a 'winfixheight' window (9.2.0871).\n  * popup with opacity does not use the font of the highlight group (9.2.0872).\n  * :redrawstatus does not update the ruler of the last window (9.2.0873).\n  * fold size is compared against 'foldminlines' of the wrong window (9.2.0874).\n  * GTK4: GUI does not support command-line arguments (9.2.0875).\n  * GTK4: compile error with disabled netbeans feat (9.2.0876).\n  * Vim9: crash when a closure assigns to a variable declared in a loop (9.2.0877).\n  * Vim9: cannot use a script variable of an enclosing block in a lambda (9.2.0878).\n  * popup: \"maxwidth\" is not respected when 'wrap' is off (9.2.0879).\n  * scroll: window scrolls when using the autocommand window (9.2.0880).\n  * 'smoothscroll' position is lost when the window height changes (9.2.0881).\n  * :bwipe crashes if WinLeave wipes all other buffers (9.2.0882).\n  * scroll: 'smoothscroll' position is lost when using \"|\" (9.2.0883).\n  * scroll: unreachable 'smoothscroll' code in cursor_correct() (9.2.0884).\n  * scroll: 'smoothscroll' position is lost when the window is squeezed (9.2.0885).\n  * :set completion works for an invalid sub-option name (9.2.0886).\n  * scroll: jump-scrolling when moving the cursor onto a wrapping line (9.2.0887).\n  * mapping: modifier is not recognized after a partial mapping (9.2.0888).\n  * VMS: spurious \"INVALID DECC FEATURE VALUE\" message at every startup (9.2.0889).\n  * test: test for patch v9.2.0888 can be clarified (9.2.0890).\n  * MS-Windows: filename-modifier \":8:t\" causes underflow (9.2.0891).\n  * highlight: wrong column highlighted with 'cursorcolumn' (9.2.0892).\n  * MS-Windows: \"*.vim\" also matches files with a longer extension (9.2.0893).\n  * filetype: ed script files not recognised (9.2.0894).\n  * test: Test_aucmd_win_scroll_multibyte() is flaky in the GUI (9.2.0895).\n  * scroll: 'smoothscroll' position is lost when splitting a window (9.2.0896).\n  * GTK3 X11 redraws are not coalesced (9.2.0897).\n  * printing support is lacking (9.2.0898).\n  * command output temporary files may collide (9.2.0899).\n  * FocusGained still triggered when closing dialog (9.2.0900).\n  * textprop: wrong cursor line with truncated virtual text (9.2.0901).\n  * Vim9: iterating over a tuple leaks memory (9.2.0902).\n  * Vim9: cannot use an exported function of an autoload import (9.2.0903).\n  * \"zb\" scrolls incorrectly with cursor just above fold (9.2.0904).\n  * MS-Windows: ghost cursor with ligatures (9.2.0905).\n  * slow transstr() with long strings (9.2.0906).\n  * popup: virtual text is not redrawn when a text property changes (9.2.0907).\n  * cannot use a {} block in a nested :autocmd (9.2.0908).\n  * insert completion is slow to collect many matches (9.2.0909).\n  * runtime(vim): update syntax, contain Ex commands (9.2.0910).\n  * makefiles do not build hardcopy_postscript.c (9.2.0911).\n  * hardcopy: prototypes are hand-written instead of generated (9.2.0912).\n  * statusline: cell below the vertical separator keeps the old highlight (9.2.0913).\n  * diff: undo after :diffget into an empty buffer leaves a line behind (9.2.0914).\n  * tests: two terminal tests in test_popupwin fail on FreeBSD (9.2.0915).\n  * configure: honor `--disable-hardcopy-pango` with GTK UI (9.2.0916).\n  * :quitall not allowed in the command-line window (9.2.0917).\n  * screen: fill char with a zero low byte is stored as a NUL cell (9.2.0918).\n  * screen: the wrong array is copied into ScreenCols on a resize (9.2.0919).\n  * filetype: json-ld files are not recognized (9.2.0920).\n  * test: terminal tests fail on FreeBSD (9.2.0921).\n  * Wayland: modeless selection not redrawn (9.2.0922).\n  * tabpage: closing a tab page loses the alternate tab page (9.2.0923).\n  * tests: Test_termwinscroll() fails on FreeBSD (9.2.0924).\n  * crash when getcompletiontype() gets a NULL string (9.2.0925).\n  * filetype: business Central files are not recognized (9.2.0926).\n  * curswant not set on 8g8 (9.2.0927).\n  * MinGW: tests hang when Vim is built with coverage enabled (9.2.0928).\n  * incorrect completion for 'pumopt' and 'pumborder' (9.2.0929).\n  * floating point exception when displaying pum (9.2.0930).\n  * the GTK4 GUI is still experimental and untested by CI (9.2.0931).\n  * NFA engine fallback can double free the compiled program (9.2.0932).\n  * u_read_undo() leaks the file name when the undo file owner differs (9.2.0933).\n  * filetype: hlsl files are not recognized (9.2.0934).\n  * reading an undo file is slow with many undo headers (9.2.0935).\n  * stringifying a list or dict can free the item being iterated (9.2.0936).\n  * sort() with a numeric option converts each item on every comparison (9.2.0937).\n  * cursorbind: cursor in the other window is not updated after undo (9.2.0938).\n  * mbyte: wrong cell count for an overlong UTF-8 sequence (9.2.0939).\n  * GTK4: columns are lost when a scrollbar appears (9.2.0940).\n  * tests: clipboard tests fail in the GUI when the terminal has no clipboard (9.2.0941).\n  * test: test_mksession_winpos() fails on GTK4 UI (9.2.0942).\n  * test: test_hardcopy fails on GTK4 UI (9.2.0943).\n  * test: tests fail when checking for GTK4 feature (9.2.0944).\n  * sort() with a numeric option can be improved (9.2.0945).\n  * GTK2/3: mouse move starts Visual selection after a dialog (9.2.0946).\n  * GTK4: screen is cleared when moving the mouse after startup (9.2.0947).\n  * GTK4: mouse move starts Visual selection after a dialog (9.2.0948).\n  * GDK_KEY_VoidSymbol might be undefined (9.2.0949).\n  * transstr() can be improved (after 9.2.0906) (9.2.0950).\n  * GTK3: cursor does no longer blink (9.2.0951).\n  * locking a container while stringifying can be improved (9.2.0952).\n  * insert completion code can be improved (9.2.0953).\n  * u_read_undo() can be improved (after 9.2.0935) (9.2.0954).\n  * tests: terminal tests are flaky (9.2.0955).\n  * GTK4: crash when the window is resized while redrawing (9.2.0956).\n  * filetype: ArgoCD config file is not recognized (9.2.0957).\n","status":"published","published":"2026-08-18T10:47:36Z","modified":"2026-08-26T18:23:31.209546735Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23365-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\nUpdated to version 9.2.0957.\n\n- CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).\n- CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).\n- CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution\n  (bsc#1275016).\n- CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution\n  (bsc#1275015).\n- CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).\n- CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).\n- CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).\n- CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).\n\nChanges for vim:\n\n- Version 9.2.0957:\n  * tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).\n  * tests: missing cleanup in test_mksession.vim (9.2.0782).\n  * tests: personal spell files leak into later tests (9.2.0783).\n  * crash when borrowing statusline highlight in silent Ex mode (9.2.0784).\n  * WinResized not triggered when the whole Vim is resized (9.2.0785).\n  * filetype: containerfile is not recognized (9.2.0786).\n  * regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).\n  * filetype: hip files are not recognized (9.2.0788).\n  * 'statuslineopt' status line too high after a window is minimized (9.2.0789).\n  * 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).\n  * wincol() counts from right side for 'rightleft' (9.2.0791).\n  * runtime(netrw): explore without optional dir broken (9.2.0792).\n  * if session restored a tiny window, restore fails (9.2.0793).\n  * extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).\n  * popup menu shadow is not cleared when the menu shrinks (9.2.0795).\n  * Visual block reselection wrong with 'virtualedit' (9.2.0796).\n  * memory leak in get_qfline_items() on alloc failure (9.2.0797).\n  * memory leak in compile_expr6() on alloc failure (9.2.0798).\n  * memory leak in compile_def_function_body() on alloc failure (9.2.0799).\n  * memory leak in call_func() on alloc failure (9.2.0800).\n  * memory leak in f_getreginfo() on alloc failure (9.2.0801).\n  * memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).\n  * memory leak on alloc failure with taglist/gettagstack() (9.2.0803).\n  * wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).\n  * screenpos() \"curscol\" is wrong with 'rightleft' (9.2.0805).\n  * 'showcmd' may show internal command keys (9.2.0806).\n  * MS-Windows: ellipsis character is garbled (9.2.0807).\n  * getregionpos: double-free on alloc failure (9.2.0808).\n  * getframelayout() uses wrong function to free lists (9.2.0809).\n  * add_llist_tags() uses wrong function to free dict (9.2.0810).\n  * mksession writes terminal command unquoted (9.2.0811).\n  * :argdelete with pattern leads to wrong argidx() (9.2.0812).\n  * dict_add_func() may corrupt funcref count on failure (9.2.0813).\n  * Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).\n  * deeply nested regexp patterns may cause stack overflow (9.2.0815).\n  * GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).\n  * crash when building a stacktrace during an autocommand (9.2.0817).\n  * tests: client-server test fails without X11 server (9.2.0818).\n  * MS-Windows: sixel image shown as raw text in the console (9.2.0819).\n  * GUI: hidden popup image is displayed and not erased (9.2.0820).\n  * filetype: msmtp system-wide rc file not detected (9.2.0821).\n  * GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).\n  * tests: Test_clientserver_servlist_list may fail (9.2.0823).\n  * Makefile: make tags depends on configure (9.2.0824).\n  * regexp: submatch in a look-behind is empty with the NFA engine (9.2.0825).\n  * highlighting for broken terminals can be improved (9.2.0826).\n  * :startinsert enters Insert mode in a non-modifiable buffer (9.2.0827).\n  * GTK4: hardware rendering can be improved (9.2.0828).\n  * sessions do not preserve script version for expression options (9.2.0829).\n  * the completion menu is not used on terminals without colors (9.2.0830).\n  * diff highlighting hard to read with syntax enabled (9.2.0831).\n  * socketserver: remote commands can be processed in reverse order (9.2.0832).\n  * GTK4: menu mnemonics do not work properly (9.2.0833).\n  * cleared last search pattern is restored from viminfo (9.2.0834).\n  * features in version.c are not sorted (9.2.0835).\n  * filetype: .git-blame-ignore-revs file is not recognized (9.2.0836).\n  * using wrong colors in hl_blend_attr() (9.2.0837).\n  * searchcount() returns wrong cached maxcount (9.2.0838).\n  * [security]: arbitrary code execution via keyword lookup (9.2.0839).\n  * [security]: code injection in netrw via bookmarks (9.2.0840).\n  * [security]: heap overflow when adding \u003e 65535 text properties (9.2.0841).\n  * [security]: stack buffer overflow in socket server (9.2.0842).\n  * [security]: popup: opacity mask indexed out of bounds (9.2.0843).\n  * [security]: use-after-free on json decode error (9.2.0844).\n  * [security]: arbitrary Ex command execution during C omni-completion (9.2.0845).\n  * [security]: heap buffer overflow in set_sofo() (9.2.0846).\n  * [security]: vimball: code execution via .VimballRecord file (9.2.0847).\n  * tagfunc \"cmd\" with a generic Ex command corrupts the tag entry (9.2.0848).\n  * filetype: osquery config files are not recognized (9.2.0849).\n  * MS-Windows: commands from a client can be lost (9.2.0850).\n  * focus autocommands triggered inconsistently (9.2.0851).\n  * GTK: ligatures not correctly displayed (9.2.0852).\n  * popup: popup images do not support scaling (9.2.0853).\n  * memory leak when reading a spell file with SN_SAL and SN_SOFO (9.2.0854).\n  * 'showcmd' not redrawn with empty mapping triggered on timeout (9.2.0855).\n  * GTK4: undercurl rendering is inefficient (9.2.0856).\n  * popup: opacity popup over a terminal is not cleared when closed (9.2.0857).\n  * MS-Windows GUI: white flash when VimEnter is slow (9.2.0858).\n  * GTK2: link error (9.2.0859).\n  * filetype: xilinx design constraint files are not recognized (9.2.0860).\n  * GTK4: bleed region updates in jumps (9.2.0861).\n  * missing test change from v9.2.0857 (9.2.0862).\n  * MS-Windows GUI: window contents can be missing when VimEnter is slow (9.2.0863).\n  * using some dead code in Wayland feature (9.2.0864).\n  * GTK4: non-hardware accelerated UI is too slow (9.2.0865).\n  * MS-Windows: \":language messages\" only works once (9.2.0866).\n  * MS-Windows: messages are not in the display language (9.2.0867).\n  * GTK: window Manager hint prevents giving focus to dialog (9.2.0868).\n  * buf_copy_options() can lose the P_INSECURE flag (9.2.0869).\n  * filetype: marko files are not recognized (9.2.0870).\n  * screen line is lost when splitting a 'winfixheight' window (9.2.0871).\n  * popup with opacity does not use the font of the highlight group (9.2.0872).\n  * :redrawstatus does not update the ruler of the last window (9.2.0873).\n  * fold size is compared against 'foldminlines' of the wrong window (9.2.0874).\n  * GTK4: GUI does not support command-line arguments (9.2.0875).\n  * GTK4: compile error with disabled netbeans feat (9.2.0876).\n  * Vim9: crash when a closure assigns to a variable declared in a loop (9.2.0877).\n  * Vim9: cannot use a script variable of an enclosing block in a lambda (9.2.0878).\n  * popup: \"maxwidth\" is not respected when 'wrap' is off (9.2.0879).\n  * scroll: window scrolls when using the autocommand window (9.2.0880).\n  * 'smoothscroll' position is lost when the window height changes (9.2.0881).\n  * :bwipe crashes if WinLeave wipes all other buffers (9.2.0882).\n  * scroll: 'smoothscroll' position is lost when using \"|\" (9.2.0883).\n  * scroll: unreachable 'smoothscroll' code in cursor_correct() (9.2.0884).\n  * scroll: 'smoothscroll' position is lost when the window is squeezed (9.2.0885).\n  * :set completion works for an invalid sub-option name (9.2.0886).\n  * scroll: jump-scrolling when moving the cursor onto a wrapping line (9.2.0887).\n  * mapping: modifier is not recognized after a partial mapping (9.2.0888).\n  * VMS: spurious \"INVALID DECC FEATURE VALUE\" message at every startup (9.2.0889).\n  * test: test for patch v9.2.0888 can be clarified (9.2.0890).\n  * MS-Windows: filename-modifier \":8:t\" causes underflow (9.2.0891).\n  * highlight: wrong column highlighted with 'cursorcolumn' (9.2.0892).\n  * MS-Windows: \"*.vim\" also matches files with a longer extension (9.2.0893).\n  * filetype: ed script files not recognised (9.2.0894).\n  * test: Test_aucmd_win_scroll_multibyte() is flaky in the GUI (9.2.0895).\n  * scroll: 'smoothscroll' position is lost when splitting a window (9.2.0896).\n  * GTK3 X11 redraws are not coalesced (9.2.0897).\n  * printing support is lacking (9.2.0898).\n  * command output temporary files may collide (9.2.0899).\n  * FocusGained still triggered when closing dialog (9.2.0900).\n  * textprop: wrong cursor line with truncated virtual text (9.2.0901).\n  * Vim9: iterating over a tuple leaks memory (9.2.0902).\n  * Vim9: cannot use an exported function of an autoload import (9.2.0903).\n  * \"zb\" scrolls incorrectly with cursor just above fold (9.2.0904).\n  * MS-Windows: ghost cursor with ligatures (9.2.0905).\n  * slow transstr() with long strings (9.2.0906).\n  * popup: virtual text is not redrawn when a text property changes (9.2.0907).\n  * cannot use a {} block in a nested :autocmd (9.2.0908).\n  * insert completion is slow to collect many matches (9.2.0909).\n  * runtime(vim): update syntax, contain Ex commands (9.2.0910).\n  * makefiles do not build hardcopy_postscript.c (9.2.0911).\n  * hardcopy: prototypes are hand-written instead of generated (9.2.0912).\n  * statusline: cell below the vertical separator keeps the old highlight (9.2.0913).\n  * diff: undo after :diffget into an empty buffer leaves a line behind (9.2.0914).\n  * tests: two terminal tests in test_popupwin fail on FreeBSD (9.2.0915).\n  * configure: honor `--disable-hardcopy-pango` with GTK UI (9.2.0916).\n  * :quitall not allowed in the command-line window (9.2.0917).\n  * screen: fill char with a zero low byte is stored as a NUL cell (9.2.0918).\n  * screen: the wrong array is copied into ScreenCols on a resize (9.2.0919).\n  * filetype: json-ld files are not recognized (9.2.0920).\n  * test: terminal tests fail on FreeBSD (9.2.0921).\n  * Wayland: modeless selection not redrawn (9.2.0922).\n  * tabpage: closing a tab page loses the alternate tab page (9.2.0923).\n  * tests: Test_termwinscroll() fails on FreeBSD (9.2.0924).\n  * crash when getcompletiontype() gets a NULL string (9.2.0925).\n  * filetype: business Central files are not recognized (9.2.0926).\n  * curswant not set on 8g8 (9.2.0927).\n  * MinGW: tests hang when Vim is built with coverage enabled (9.2.0928).\n  * incorrect completion for 'pumopt' and 'pumborder' (9.2.0929).\n  * floating point exception when displaying pum (9.2.0930).\n  * the GTK4 GUI is still experimental and untested by CI (9.2.0931).\n  * NFA engine fallback can double free the compiled program (9.2.0932).\n  * u_read_undo() leaks the file name when the undo file owner differs (9.2.0933).\n  * filetype: hlsl files are not recognized (9.2.0934).\n  * reading an undo file is slow with many undo headers (9.2.0935).\n  * stringifying a list or dict can free the item being iterated (9.2.0936).\n  * sort() with a numeric option converts each item on every comparison (9.2.0937).\n  * cursorbind: cursor in the other window is not updated after undo (9.2.0938).\n  * mbyte: wrong cell count for an overlong UTF-8 sequence (9.2.0939).\n  * GTK4: columns are lost when a scrollbar appears (9.2.0940).\n  * tests: clipboard tests fail in the GUI when the terminal has no clipboard (9.2.0941).\n  * test: test_mksession_winpos() fails on GTK4 UI (9.2.0942).\n  * test: test_hardcopy fails on GTK4 UI (9.2.0943).\n  * test: tests fail when checking for GTK4 feature (9.2.0944).\n  * sort() with a numeric option can be improved (9.2.0945).\n  * GTK2/3: mouse move starts Visual selection after a dialog (9.2.0946).\n  * GTK4: screen is cleared when moving the mouse after startup (9.2.0947).\n  * GTK4: mouse move starts Visual selection after a dialog (9.2.0948).\n  * GDK_KEY_VoidSymbol might be undefined (9.2.0949).\n  * transstr() can be improved (after 9.2.0906) (9.2.0950).\n  * GTK3: cursor does no longer blink (9.2.0951).\n  * locking a container while stringifying can be improved (9.2.0952).\n  * insert completion code can be improved (9.2.0953).\n  * u_read_undo() can be improved (after 9.2.0935) (9.2.0954).\n  * tests: terminal tests are flaky (9.2.0955).\n  * GTK4: crash when the window is resized while redrawing (9.2.0956).\n  * filetype: ArgoCD config file is not recognized (9.2.0957).\n","status":"published","published":"2026-08-28T11:33:15Z","modified":"2026-09-10T18:23:13.408559484Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23391-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\nUpdated to version 9.2.0957.\n\nSecurity issues fixed:\n\n- CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).\n- CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).\n- CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution\n  (bsc#1275016).\n- CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution\n  (bsc#1275015).\n- CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).\n- CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).\n- CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).\n- CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).\n\nOther updates and bugfixes:\n\n- Version 9.2.0957.\n  * tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).\n  * tests: missing cleanup in test_mksession.vim (9.2.0782).\n  * tests: personal spell files leak into later tests (9.2.0783).\n  * crash when borrowing statusline highlight in silent Ex mode (9.2.0784).\n  * WinResized not triggered when the whole Vim is resized (9.2.0785).\n  * filetype: containerfile is not recognized (9.2.0786).\n  * regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).\n  * filetype: hip files are not recognized (9.2.0788).\n  * 'statuslineopt' status line too high after a window is minimized (9.2.0789).\n  * 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).\n  * wincol() counts from right side for 'rightleft' (9.2.0791).\n  * runtime(netrw): explore without optional dir broken (9.2.0792).\n  * if session restored a tiny window, restore fails (9.2.0793).\n  * extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).\n  * popup menu shadow is not cleared when the menu shrinks (9.2.0795).\n  * Visual block reselection wrong with 'virtualedit' (9.2.0796).\n  * memory leak in get_qfline_items() on alloc failure (9.2.0797).\n  * memory leak in compile_expr6() on alloc failure (9.2.0798).\n  * memory leak in compile_def_function_body() on alloc failure (9.2.0799).\n  * memory leak in call_func() on alloc failure (9.2.0800).\n  * memory leak in f_getreginfo() on alloc failure (9.2.0801).\n  * memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).\n  * memory leak on alloc failure with taglist/gettagstack() (9.2.0803).\n  * wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).\n  * screenpos() \"curscol\" is wrong with 'rightleft' (9.2.0805).\n  * 'showcmd' may show internal command keys (9.2.0806).\n  * MS-Windows: ellipsis character is garbled (9.2.0807).\n  * getregionpos: double-free on alloc failure (9.2.0808).\n  * getframelayout() uses wrong function to free lists (9.2.0809).\n  * add_llist_tags() uses wrong function to free dict (9.2.0810).\n  * mksession writes terminal command unquoted (9.2.0811).\n  * :argdelete with pattern leads to wrong argidx() (9.2.0812).\n  * dict_add_func() may corrupt funcref count on failure (9.2.0813).\n  * Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).\n  * deeply nested regexp patterns may cause stack overflow (9.2.0815).\n  * GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).\n  * crash when building a stacktrace during an autocommand (9.2.0817).\n  * tests: client-server test fails without X11 server (9.2.0818).\n  * MS-Windows: sixel image shown as raw text in the console (9.2.0819).\n  * GUI: hidden popup image is displayed and not erased (9.2.0820).\n  * filetype: msmtp system-wide rc file not detected (9.2.0821).\n  * GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).\n  * tests: Test_clientserver_servlist_list may fail (9.2.0823).\n  * Makefile: make tags depends on configure (9.2.0824).\n  * regexp: submatch in a look-behind is empty with the NFA engine (9.2.0825).\n  * highlighting for broken terminals can be improved (9.2.0826).\n  * :startinsert enters Insert mode in a non-modifiable buffer (9.2.0827).\n  * GTK4: hardware rendering can be improved (9.2.0828).\n  * sessions do not preserve script version for expression options (9.2.0829).\n  * the completion menu is not used on terminals without colors (9.2.0830).\n  * diff highlighting hard to read with syntax enabled (9.2.0831).\n  * socketserver: remote commands can be processed in reverse order (9.2.0832).\n  * GTK4: menu mnemonics do not work properly (9.2.0833).\n  * cleared last search pattern is restored from viminfo (9.2.0834).\n  * features in version.c are not sorted (9.2.0835).\n  * filetype: .git-blame-ignore-revs file is not recognized (9.2.0836).\n  * using wrong colors in hl_blend_attr() (9.2.0837).\n  * searchcount() returns wrong cached maxcount (9.2.0838).\n  * [security]: arbitrary code execution via keyword lookup (9.2.0839).\n  * [security]: code injection in netrw via bookmarks (9.2.0840).\n  * [security]: heap overflow when adding \u003e 65535 text properties (9.2.0841).\n  * [security]: stack buffer overflow in socket server (9.2.0842).\n  * [security]: popup: opacity mask indexed out of bounds (9.2.0843).\n  * [security]: use-after-free on json decode error (9.2.0844).\n  * [security]: arbitrary Ex command execution during C omni-completion (9.2.0845).\n  * [security]: heap buffer overflow in set_sofo() (9.2.0846).\n  * [security]: vimball: code execution via .VimballRecord file (9.2.0847).\n  * tagfunc \"cmd\" with a generic Ex command corrupts the tag entry (9.2.0848).\n  * filetype: osquery config files are not recognized (9.2.0849).\n  * MS-Windows: commands from a client can be lost (9.2.0850).\n  * focus autocommands triggered inconsistently (9.2.0851).\n  * GTK: ligatures not correctly displayed (9.2.0852).\n  * popup: popup images do not support scaling (9.2.0853).\n  * memory leak when reading a spell file with SN_SAL and SN_SOFO (9.2.0854).\n  * 'showcmd' not redrawn with empty mapping triggered on timeout (9.2.0855).\n  * GTK4: undercurl rendering is inefficient (9.2.0856).\n  * popup: opacity popup over a terminal is not cleared when closed (9.2.0857).\n  * MS-Windows GUI: white flash when VimEnter is slow (9.2.0858).\n  * GTK2: link error (9.2.0859).\n  * filetype: xilinx design constraint files are not recognized (9.2.0860).\n  * GTK4: bleed region updates in jumps (9.2.0861).\n  * missing test change from v9.2.0857 (9.2.0862).\n  * MS-Windows GUI: window contents can be missing when VimEnter is slow (9.2.0863).\n  * using some dead code in Wayland feature (9.2.0864).\n  * GTK4: non-hardware accelerated UI is too slow (9.2.0865).\n  * MS-Windows: \":language messages\" only works once (9.2.0866).\n  * MS-Windows: messages are not in the display language (9.2.0867).\n  * GTK: window Manager hint prevents giving focus to dialog (9.2.0868).\n  * buf_copy_options() can lose the P_INSECURE flag (9.2.0869).\n  * filetype: marko files are not recognized (9.2.0870).\n  * screen line is lost when splitting a 'winfixheight' window (9.2.0871).\n  * popup with opacity does not use the font of the highlight group (9.2.0872).\n  * :redrawstatus does not update the ruler of the last window (9.2.0873).\n  * fold size is compared against 'foldminlines' of the wrong window (9.2.0874).\n  * GTK4: GUI does not support command-line arguments (9.2.0875).\n  * GTK4: compile error with disabled netbeans feat (9.2.0876).\n  * Vim9: crash when a closure assigns to a variable declared in a loop (9.2.0877).\n  * Vim9: cannot use a script variable of an enclosing block in a lambda (9.2.0878).\n  * popup: \"maxwidth\" is not respected when 'wrap' is off (9.2.0879).\n  * scroll: window scrolls when using the autocommand window (9.2.0880).\n  * 'smoothscroll' position is lost when the window height changes (9.2.0881).\n  * :bwipe crashes if WinLeave wipes all other buffers (9.2.0882).\n  * scroll: 'smoothscroll' position is lost when using \"|\" (9.2.0883).\n  * scroll: unreachable 'smoothscroll' code in cursor_correct() (9.2.0884).\n  * scroll: 'smoothscroll' position is lost when the window is squeezed (9.2.0885).\n  * :set completion works for an invalid sub-option name (9.2.0886).\n  * scroll: jump-scrolling when moving the cursor onto a wrapping line (9.2.0887).\n  * mapping: modifier is not recognized after a partial mapping (9.2.0888).\n  * VMS: spurious \"INVALID DECC FEATURE VALUE\" message at every startup (9.2.0889).\n  * test: test for patch v9.2.0888 can be clarified (9.2.0890).\n  * MS-Windows: filename-modifier \":8:t\" causes underflow (9.2.0891).\n  * highlight: wrong column highlighted with 'cursorcolumn' (9.2.0892).\n  * MS-Windows: \"*.vim\" also matches files with a longer extension (9.2.0893).\n  * filetype: ed script files not recognised (9.2.0894).\n  * test: Test_aucmd_win_scroll_multibyte() is flaky in the GUI (9.2.0895).\n  * scroll: 'smoothscroll' position is lost when splitting a window (9.2.0896).\n  * GTK3 X11 redraws are not coalesced (9.2.0897).\n  * printing support is lacking (9.2.0898).\n  * command output temporary files may collide (9.2.0899).\n  * FocusGained still triggered when closing dialog (9.2.0900).\n  * textprop: wrong cursor line with truncated virtual text (9.2.0901).\n  * Vim9: iterating over a tuple leaks memory (9.2.0902).\n  * Vim9: cannot use an exported function of an autoload import (9.2.0903).\n  * \"zb\" scrolls incorrectly with cursor just above fold (9.2.0904).\n  * MS-Windows: ghost cursor with ligatures (9.2.0905).\n  * slow transstr() with long strings (9.2.0906).\n  * popup: virtual text is not redrawn when a text property changes (9.2.0907).\n  * cannot use a {} block in a nested :autocmd (9.2.0908).\n  * insert completion is slow to collect many matches (9.2.0909).\n  * runtime(vim): update syntax, contain Ex commands (9.2.0910).\n  * makefiles do not build hardcopy_postscript.c (9.2.0911).\n  * hardcopy: prototypes are hand-written instead of generated (9.2.0912).\n  * statusline: cell below the vertical separator keeps the old highlight (9.2.0913).\n  * diff: undo after :diffget into an empty buffer leaves a line behind (9.2.0914).\n  * tests: two terminal tests in test_popupwin fail on FreeBSD (9.2.0915).\n  * configure: honor `--disable-hardcopy-pango` with GTK UI (9.2.0916).\n  * :quitall not allowed in the command-line window (9.2.0917).\n  * screen: fill char with a zero low byte is stored as a NUL cell (9.2.0918).\n  * screen: the wrong array is copied into ScreenCols on a resize (9.2.0919).\n  * filetype: json-ld files are not recognized (9.2.0920).\n  * test: terminal tests fail on FreeBSD (9.2.0921).\n  * Wayland: modeless selection not redrawn (9.2.0922).\n  * tabpage: closing a tab page loses the alternate tab page (9.2.0923).\n  * tests: Test_termwinscroll() fails on FreeBSD (9.2.0924).\n  * crash when getcompletiontype() gets a NULL string (9.2.0925).\n  * filetype: business Central files are not recognized (9.2.0926).\n  * curswant not set on 8g8 (9.2.0927).\n  * MinGW: tests hang when Vim is built with coverage enabled (9.2.0928).\n  * incorrect completion for 'pumopt' and 'pumborder' (9.2.0929).\n  * floating point exception when displaying pum (9.2.0930).\n  * the GTK4 GUI is still experimental and untested by CI (9.2.0931).\n  * NFA engine fallback can double free the compiled program (9.2.0932).\n  * u_read_undo() leaks the file name when the undo file owner differs (9.2.0933).\n  * filetype: hlsl files are not recognized (9.2.0934).\n  * reading an undo file is slow with many undo headers (9.2.0935).\n  * stringifying a list or dict can free the item being iterated (9.2.0936).\n  * sort() with a numeric option converts each item on every comparison (9.2.0937).\n  * cursorbind: cursor in the other window is not updated after undo (9.2.0938).\n  * mbyte: wrong cell count for an overlong UTF-8 sequence (9.2.0939).\n  * GTK4: columns are lost when a scrollbar appears (9.2.0940).\n  * tests: clipboard tests fail in the GUI when the terminal has no clipboard (9.2.0941).\n  * test: test_mksession_winpos() fails on GTK4 UI (9.2.0942).\n  * test: test_hardcopy fails on GTK4 UI (9.2.0943).\n  * test: tests fail when checking for GTK4 feature (9.2.0944).\n  * sort() with a numeric option can be improved (9.2.0945).\n  * GTK2/3: mouse move starts Visual selection after a dialog (9.2.0946).\n  * GTK4: screen is cleared when moving the mouse after startup (9.2.0947).\n  * GTK4: mouse move starts Visual selection after a dialog (9.2.0948).\n  * GDK_KEY_VoidSymbol might be undefined (9.2.0949).\n  * transstr() can be improved (after 9.2.0906) (9.2.0950).\n  * GTK3: cursor does no longer blink (9.2.0951).\n  * locking a container while stringifying can be improved (9.2.0952).\n  * insert completion code can be improved (9.2.0953).\n  * u_read_undo() can be improved (after 9.2.0935) (9.2.0954).\n  * tests: terminal tests are flaky (9.2.0955).\n  * GTK4: crash when the window is resized while redrawing (9.2.0956).\n  * filetype: ArgoCD config file is not recognized (9.2.0957).\n- Allow `wrap` and `linebreak` to be set from a modeline (bsc#1268162).\n- Point `SYS_VIMRC_FILE` at `$VIMRUNTIME/suse.vimrc` rather than `/etc/vimrc`, which we no longer own (bsc#1268162).\n- Update `suse.vimrc`: source `/etc/vimrc` at the end of the file, so that a local system vimrc still overrides the\n  distribution defaults.\n- Guard `suse.vimrc` against re-entry to prevent an infinite sourcing loop (bsc#1271684).\n","status":"published","published":"2026-08-28T08:28:19Z","modified":"2026-09-10T18:23:15.357442539Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23393-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\nUpdated to version 9.2.0957.\n\nSecurity issues fixed:\n\n- CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).\n- CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).\n- CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution\n  (bsc#1275016).\n- CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution\n  (bsc#1275015).\n- CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).\n- CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).\n- CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).\n- CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).\n\nOther updates and bugfixes:\n\n- Version 9.2.0957.\n  * tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).\n  * tests: missing cleanup in test_mksession.vim (9.2.0782).\n  * tests: personal spell files leak into later tests (9.2.0783).\n  * crash when borrowing statusline highlight in silent Ex mode (9.2.0784).\n  * WinResized not triggered when the whole Vim is resized (9.2.0785).\n  * filetype: containerfile is not recognized (9.2.0786).\n  * regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).\n  * filetype: hip files are not recognized (9.2.0788).\n  * 'statuslineopt' status line too high after a window is minimized (9.2.0789).\n  * 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).\n  * wincol() counts from right side for 'rightleft' (9.2.0791).\n  * runtime(netrw): explore without optional dir broken (9.2.0792).\n  * if session restored a tiny window, restore fails (9.2.0793).\n  * extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).\n  * popup menu shadow is not cleared when the menu shrinks (9.2.0795).\n  * Visual block reselection wrong with 'virtualedit' (9.2.0796).\n  * memory leak in get_qfline_items() on alloc failure (9.2.0797).\n  * memory leak in compile_expr6() on alloc failure (9.2.0798).\n  * memory leak in compile_def_function_body() on alloc failure (9.2.0799).\n  * memory leak in call_func() on alloc failure (9.2.0800).\n  * memory leak in f_getreginfo() on alloc failure (9.2.0801).\n  * memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).\n  * memory leak on alloc failure with taglist/gettagstack() (9.2.0803).\n  * wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).\n  * screenpos() \"curscol\" is wrong with 'rightleft' (9.2.0805).\n  * 'showcmd' may show internal command keys (9.2.0806).\n  * MS-Windows: ellipsis character is garbled (9.2.0807).\n  * getregionpos: double-free on alloc failure (9.2.0808).\n  * getframelayout() uses wrong function to free lists (9.2.0809).\n  * add_llist_tags() uses wrong function to free dict (9.2.0810).\n  * mksession writes terminal command unquoted (9.2.0811).\n  * :argdelete with pattern leads to wrong argidx() (9.2.0812).\n  * dict_add_func() may corrupt funcref count on failure (9.2.0813).\n  * Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).\n  * deeply nested regexp patterns may cause stack overflow (9.2.0815).\n  * GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).\n  * crash when building a stacktrace during an autocommand (9.2.0817).\n  * tests: client-server test fails without X11 server (9.2.0818).\n  * MS-Windows: sixel image shown as raw text in the console (9.2.0819).\n  * GUI: hidden popup image is displayed and not erased (9.2.0820).\n  * filetype: msmtp system-wide rc file not detected (9.2.0821).\n  * GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).\n  * tests: Test_clientserver_servlist_list may fail (9.2.0823).\n  * Makefile: make tags depends on configure (9.2.0824).\n  * regexp: submatch in a look-behind is empty with the NFA engine (9.2.0825).\n  * highlighting for broken terminals can be improved (9.2.0826).\n  * :startinsert enters Insert mode in a non-modifiable buffer (9.2.0827).\n  * GTK4: hardware rendering can be improved (9.2.0828).\n  * sessions do not preserve script version for expression options (9.2.0829).\n  * the completion menu is not used on terminals without colors (9.2.0830).\n  * diff highlighting hard to read with syntax enabled (9.2.0831).\n  * socketserver: remote commands can be processed in reverse order (9.2.0832).\n  * GTK4: menu mnemonics do not work properly (9.2.0833).\n  * cleared last search pattern is restored from viminfo (9.2.0834).\n  * features in version.c are not sorted (9.2.0835).\n  * filetype: .git-blame-ignore-revs file is not recognized (9.2.0836).\n  * using wrong colors in hl_blend_attr() (9.2.0837).\n  * searchcount() returns wrong cached maxcount (9.2.0838).\n  * [security]: arbitrary code execution via keyword lookup (9.2.0839).\n  * [security]: code injection in netrw via bookmarks (9.2.0840).\n  * [security]: heap overflow when adding \u003e 65535 text properties (9.2.0841).\n  * [security]: stack buffer overflow in socket server (9.2.0842).\n  * [security]: popup: opacity mask indexed out of bounds (9.2.0843).\n  * [security]: use-after-free on json decode error (9.2.0844).\n  * [security]: arbitrary Ex command execution during C omni-completion (9.2.0845).\n  * [security]: heap buffer overflow in set_sofo() (9.2.0846).\n  * [security]: vimball: code execution via .VimballRecord file (9.2.0847).\n  * tagfunc \"cmd\" with a generic Ex command corrupts the tag entry (9.2.0848).\n  * filetype: osquery config files are not recognized (9.2.0849).\n  * MS-Windows: commands from a client can be lost (9.2.0850).\n  * focus autocommands triggered inconsistently (9.2.0851).\n  * GTK: ligatures not correctly displayed (9.2.0852).\n  * popup: popup images do not support scaling (9.2.0853).\n  * memory leak when reading a spell file with SN_SAL and SN_SOFO (9.2.0854).\n  * 'showcmd' not redrawn with empty mapping triggered on timeout (9.2.0855).\n  * GTK4: undercurl rendering is inefficient (9.2.0856).\n  * popup: opacity popup over a terminal is not cleared when closed (9.2.0857).\n  * MS-Windows GUI: white flash when VimEnter is slow (9.2.0858).\n  * GTK2: link error (9.2.0859).\n  * filetype: xilinx design constraint files are not recognized (9.2.0860).\n  * GTK4: bleed region updates in jumps (9.2.0861).\n  * missing test change from v9.2.0857 (9.2.0862).\n  * MS-Windows GUI: window contents can be missing when VimEnter is slow (9.2.0863).\n  * using some dead code in Wayland feature (9.2.0864).\n  * GTK4: non-hardware accelerated UI is too slow (9.2.0865).\n  * MS-Windows: \":language messages\" only works once (9.2.0866).\n  * MS-Windows: messages are not in the display language (9.2.0867).\n  * GTK: window Manager hint prevents giving focus to dialog (9.2.0868).\n  * buf_copy_options() can lose the P_INSECURE flag (9.2.0869).\n  * filetype: marko files are not recognized (9.2.0870).\n  * screen line is lost when splitting a 'winfixheight' window (9.2.0871).\n  * popup with opacity does not use the font of the highlight group (9.2.0872).\n  * :redrawstatus does not update the ruler of the last window (9.2.0873).\n  * fold size is compared against 'foldminlines' of the wrong window (9.2.0874).\n  * GTK4: GUI does not support command-line arguments (9.2.0875).\n  * GTK4: compile error with disabled netbeans feat (9.2.0876).\n  * Vim9: crash when a closure assigns to a variable declared in a loop (9.2.0877).\n  * Vim9: cannot use a script variable of an enclosing block in a lambda (9.2.0878).\n  * popup: \"maxwidth\" is not respected when 'wrap' is off (9.2.0879).\n  * scroll: window scrolls when using the autocommand window (9.2.0880).\n  * 'smoothscroll' position is lost when the window height changes (9.2.0881).\n  * :bwipe crashes if WinLeave wipes all other buffers (9.2.0882).\n  * scroll: 'smoothscroll' position is lost when using \"|\" (9.2.0883).\n  * scroll: unreachable 'smoothscroll' code in cursor_correct() (9.2.0884).\n  * scroll: 'smoothscroll' position is lost when the window is squeezed (9.2.0885).\n  * :set completion works for an invalid sub-option name (9.2.0886).\n  * scroll: jump-scrolling when moving the cursor onto a wrapping line (9.2.0887).\n  * mapping: modifier is not recognized after a partial mapping (9.2.0888).\n  * VMS: spurious \"INVALID DECC FEATURE VALUE\" message at every startup (9.2.0889).\n  * test: test for patch v9.2.0888 can be clarified (9.2.0890).\n  * MS-Windows: filename-modifier \":8:t\" causes underflow (9.2.0891).\n  * highlight: wrong column highlighted with 'cursorcolumn' (9.2.0892).\n  * MS-Windows: \"*.vim\" also matches files with a longer extension (9.2.0893).\n  * filetype: ed script files not recognised (9.2.0894).\n  * test: Test_aucmd_win_scroll_multibyte() is flaky in the GUI (9.2.0895).\n  * scroll: 'smoothscroll' position is lost when splitting a window (9.2.0896).\n  * GTK3 X11 redraws are not coalesced (9.2.0897).\n  * printing support is lacking (9.2.0898).\n  * command output temporary files may collide (9.2.0899).\n  * FocusGained still triggered when closing dialog (9.2.0900).\n  * textprop: wrong cursor line with truncated virtual text (9.2.0901).\n  * Vim9: iterating over a tuple leaks memory (9.2.0902).\n  * Vim9: cannot use an exported function of an autoload import (9.2.0903).\n  * \"zb\" scrolls incorrectly with cursor just above fold (9.2.0904).\n  * MS-Windows: ghost cursor with ligatures (9.2.0905).\n  * slow transstr() with long strings (9.2.0906).\n  * popup: virtual text is not redrawn when a text property changes (9.2.0907).\n  * cannot use a {} block in a nested :autocmd (9.2.0908).\n  * insert completion is slow to collect many matches (9.2.0909).\n  * runtime(vim): update syntax, contain Ex commands (9.2.0910).\n  * makefiles do not build hardcopy_postscript.c (9.2.0911).\n  * hardcopy: prototypes are hand-written instead of generated (9.2.0912).\n  * statusline: cell below the vertical separator keeps the old highlight (9.2.0913).\n  * diff: undo after :diffget into an empty buffer leaves a line behind (9.2.0914).\n  * tests: two terminal tests in test_popupwin fail on FreeBSD (9.2.0915).\n  * configure: honor `--disable-hardcopy-pango` with GTK UI (9.2.0916).\n  * :quitall not allowed in the command-line window (9.2.0917).\n  * screen: fill char with a zero low byte is stored as a NUL cell (9.2.0918).\n  * screen: the wrong array is copied into ScreenCols on a resize (9.2.0919).\n  * filetype: json-ld files are not recognized (9.2.0920).\n  * test: terminal tests fail on FreeBSD (9.2.0921).\n  * Wayland: modeless selection not redrawn (9.2.0922).\n  * tabpage: closing a tab page loses the alternate tab page (9.2.0923).\n  * tests: Test_termwinscroll() fails on FreeBSD (9.2.0924).\n  * crash when getcompletiontype() gets a NULL string (9.2.0925).\n  * filetype: business Central files are not recognized (9.2.0926).\n  * curswant not set on 8g8 (9.2.0927).\n  * MinGW: tests hang when Vim is built with coverage enabled (9.2.0928).\n  * incorrect completion for 'pumopt' and 'pumborder' (9.2.0929).\n  * floating point exception when displaying pum (9.2.0930).\n  * the GTK4 GUI is still experimental and untested by CI (9.2.0931).\n  * NFA engine fallback can double free the compiled program (9.2.0932).\n  * u_read_undo() leaks the file name when the undo file owner differs (9.2.0933).\n  * filetype: hlsl files are not recognized (9.2.0934).\n  * reading an undo file is slow with many undo headers (9.2.0935).\n  * stringifying a list or dict can free the item being iterated (9.2.0936).\n  * sort() with a numeric option converts each item on every comparison (9.2.0937).\n  * cursorbind: cursor in the other window is not updated after undo (9.2.0938).\n  * mbyte: wrong cell count for an overlong UTF-8 sequence (9.2.0939).\n  * GTK4: columns are lost when a scrollbar appears (9.2.0940).\n  * tests: clipboard tests fail in the GUI when the terminal has no clipboard (9.2.0941).\n  * test: test_mksession_winpos() fails on GTK4 UI (9.2.0942).\n  * test: test_hardcopy fails on GTK4 UI (9.2.0943).\n  * test: tests fail when checking for GTK4 feature (9.2.0944).\n  * sort() with a numeric option can be improved (9.2.0945).\n  * GTK2/3: mouse move starts Visual selection after a dialog (9.2.0946).\n  * GTK4: screen is cleared when moving the mouse after startup (9.2.0947).\n  * GTK4: mouse move starts Visual selection after a dialog (9.2.0948).\n  * GDK_KEY_VoidSymbol might be undefined (9.2.0949).\n  * transstr() can be improved (after 9.2.0906) (9.2.0950).\n  * GTK3: cursor does no longer blink (9.2.0951).\n  * locking a container while stringifying can be improved (9.2.0952).\n  * insert completion code can be improved (9.2.0953).\n  * u_read_undo() can be improved (after 9.2.0935) (9.2.0954).\n  * tests: terminal tests are flaky (9.2.0955).\n  * GTK4: crash when the window is resized while redrawing (9.2.0956).\n  * filetype: ArgoCD config file is not recognized (9.2.0957).\n- Allow `wrap` and `linebreak` to be set from a modeline (bsc#1268162).\n- Point `SYS_VIMRC_FILE` at `$VIMRUNTIME/suse.vimrc` rather than `/etc/vimrc`, which we no longer own (bsc#1268162).\n- Update `suse.vimrc`: source `/etc/vimrc` at the end of the file, so that a local system vimrc still overrides the\n  distribution defaults.\n- Guard `suse.vimrc` against re-entry to prevent an infinite sourcing loop (bsc#1271684).\n","status":"published","published":"2026-08-28T08:29:35Z","modified":"2026-09-10T18:23:15.361877474Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23552-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\nUpdated to version 9.2.0957.\n\nSecurity issues fixed:\n\n- CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).\n- CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).\n- CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution\n  (bsc#1275016).\n- CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution\n  (bsc#1275015).\n- CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).\n- CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).\n- CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).\n- CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).\n\nOther updates and bugfixes:\n\n- Version 9.2.0957.\n  * tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).\n  * tests: missing cleanup in test_mksession.vim (9.2.0782).\n  * tests: personal spell files leak into later tests (9.2.0783).\n  * crash when borrowing statusline highlight in silent Ex mode (9.2.0784).\n  * WinResized not triggered when the whole Vim is resized (9.2.0785).\n  * filetype: containerfile is not recognized (9.2.0786).\n  * regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).\n  * filetype: hip files are not recognized (9.2.0788).\n  * 'statuslineopt' status line too high after a window is minimized (9.2.0789).\n  * 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).\n  * wincol() counts from right side for 'rightleft' (9.2.0791).\n  * runtime(netrw): explore without optional dir broken (9.2.0792).\n  * if session restored a tiny window, restore fails (9.2.0793).\n  * extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).\n  * popup menu shadow is not cleared when the menu shrinks (9.2.0795).\n  * Visual block reselection wrong with 'virtualedit' (9.2.0796).\n  * memory leak in get_qfline_items() on alloc failure (9.2.0797).\n  * memory leak in compile_expr6() on alloc failure (9.2.0798).\n  * memory leak in compile_def_function_body() on alloc failure (9.2.0799).\n  * memory leak in call_func() on alloc failure (9.2.0800).\n  * memory leak in f_getreginfo() on alloc failure (9.2.0801).\n  * memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).\n  * memory leak on alloc failure with taglist/gettagstack() (9.2.0803).\n  * wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).\n  * screenpos() \"curscol\" is wrong with 'rightleft' (9.2.0805).\n  * 'showcmd' may show internal command keys (9.2.0806).\n  * MS-Windows: ellipsis character is garbled (9.2.0807).\n  * getregionpos: double-free on alloc failure (9.2.0808).\n  * getframelayout() uses wrong function to free lists (9.2.0809).\n  * add_llist_tags() uses wrong function to free dict (9.2.0810).\n  * mksession writes terminal command unquoted (9.2.0811).\n  * :argdelete with pattern leads to wrong argidx() (9.2.0812).\n  * dict_add_func() may corrupt funcref count on failure (9.2.0813).\n  * Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).\n  * deeply nested regexp patterns may cause stack overflow (9.2.0815).\n  * GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).\n  * crash when building a stacktrace during an autocommand (9.2.0817).\n  * tests: client-server test fails without X11 server (9.2.0818).\n  * MS-Windows: sixel image shown as raw text in the console (9.2.0819).\n  * GUI: hidden popup image is displayed and not erased (9.2.0820).\n  * filetype: msmtp system-wide rc file not detected (9.2.0821).\n  * GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).\n  * tests: Test_clientserver_servlist_list may fail (9.2.0823).\n  * Makefile: make tags depends on configure (9.2.0824).\n  * regexp: submatch in a look-behind is empty with the NFA engine (9.2.0825).\n  * highlighting for broken terminals can be improved (9.2.0826).\n  * :startinsert enters Insert mode in a non-modifiable buffer (9.2.0827).\n  * GTK4: hardware rendering can be improved (9.2.0828).\n  * sessions do not preserve script version for expression options (9.2.0829).\n  * the completion menu is not used on terminals without colors (9.2.0830).\n  * diff highlighting hard to read with syntax enabled (9.2.0831).\n  * socketserver: remote commands can be processed in reverse order (9.2.0832).\n  * GTK4: menu mnemonics do not work properly (9.2.0833).\n  * cleared last search pattern is restored from viminfo (9.2.0834).\n  * features in version.c are not sorted (9.2.0835).\n  * filetype: .git-blame-ignore-revs file is not recognized (9.2.0836).\n  * using wrong colors in hl_blend_attr() (9.2.0837).\n  * searchcount() returns wrong cached maxcount (9.2.0838).\n  * [security]: arbitrary code execution via keyword lookup (9.2.0839).\n  * [security]: code injection in netrw via bookmarks (9.2.0840).\n  * [security]: heap overflow when adding \u003e 65535 text properties (9.2.0841).\n  * [security]: stack buffer overflow in socket server (9.2.0842).\n  * [security]: popup: opacity mask indexed out of bounds (9.2.0843).\n  * [security]: use-after-free on json decode error (9.2.0844).\n  * [security]: arbitrary Ex command execution during C omni-completion (9.2.0845).\n  * [security]: heap buffer overflow in set_sofo() (9.2.0846).\n  * [security]: vimball: code execution via .VimballRecord file (9.2.0847).\n  * tagfunc \"cmd\" with a generic Ex command corrupts the tag entry (9.2.0848).\n  * filetype: osquery config files are not recognized (9.2.0849).\n  * MS-Windows: commands from a client can be lost (9.2.0850).\n  * focus autocommands triggered inconsistently (9.2.0851).\n  * GTK: ligatures not correctly displayed (9.2.0852).\n  * popup: popup images do not support scaling (9.2.0853).\n  * memory leak when reading a spell file with SN_SAL and SN_SOFO (9.2.0854).\n  * 'showcmd' not redrawn with empty mapping triggered on timeout (9.2.0855).\n  * GTK4: undercurl rendering is inefficient (9.2.0856).\n  * popup: opacity popup over a terminal is not cleared when closed (9.2.0857).\n  * MS-Windows GUI: white flash when VimEnter is slow (9.2.0858).\n  * GTK2: link error (9.2.0859).\n  * filetype: xilinx design constraint files are not recognized (9.2.0860).\n  * GTK4: bleed region updates in jumps (9.2.0861).\n  * missing test change from v9.2.0857 (9.2.0862).\n  * MS-Windows GUI: window contents can be missing when VimEnter is slow (9.2.0863).\n  * using some dead code in Wayland feature (9.2.0864).\n  * GTK4: non-hardware accelerated UI is too slow (9.2.0865).\n  * MS-Windows: \":language messages\" only works once (9.2.0866).\n  * MS-Windows: messages are not in the display language (9.2.0867).\n  * GTK: window Manager hint prevents giving focus to dialog (9.2.0868).\n  * buf_copy_options() can lose the P_INSECURE flag (9.2.0869).\n  * filetype: marko files are not recognized (9.2.0870).\n  * screen line is lost when splitting a 'winfixheight' window (9.2.0871).\n  * popup with opacity does not use the font of the highlight group (9.2.0872).\n  * :redrawstatus does not update the ruler of the last window (9.2.0873).\n  * fold size is compared against 'foldminlines' of the wrong window (9.2.0874).\n  * GTK4: GUI does not support command-line arguments (9.2.0875).\n  * GTK4: compile error with disabled netbeans feat (9.2.0876).\n  * Vim9: crash when a closure assigns to a variable declared in a loop (9.2.0877).\n  * Vim9: cannot use a script variable of an enclosing block in a lambda (9.2.0878).\n  * popup: \"maxwidth\" is not respected when 'wrap' is off (9.2.0879).\n  * scroll: window scrolls when using the autocommand window (9.2.0880).\n  * 'smoothscroll' position is lost when the window height changes (9.2.0881).\n  * :bwipe crashes if WinLeave wipes all other buffers (9.2.0882).\n  * scroll: 'smoothscroll' position is lost when using \"|\" (9.2.0883).\n  * scroll: unreachable 'smoothscroll' code in cursor_correct() (9.2.0884).\n  * scroll: 'smoothscroll' position is lost when the window is squeezed (9.2.0885).\n  * :set completion works for an invalid sub-option name (9.2.0886).\n  * scroll: jump-scrolling when moving the cursor onto a wrapping line (9.2.0887).\n  * mapping: modifier is not recognized after a partial mapping (9.2.0888).\n  * VMS: spurious \"INVALID DECC FEATURE VALUE\" message at every startup (9.2.0889).\n  * test: test for patch v9.2.0888 can be clarified (9.2.0890).\n  * MS-Windows: filename-modifier \":8:t\" causes underflow (9.2.0891).\n  * highlight: wrong column highlighted with 'cursorcolumn' (9.2.0892).\n  * MS-Windows: \"*.vim\" also matches files with a longer extension (9.2.0893).\n  * filetype: ed script files not recognised (9.2.0894).\n  * test: Test_aucmd_win_scroll_multibyte() is flaky in the GUI (9.2.0895).\n  * scroll: 'smoothscroll' position is lost when splitting a window (9.2.0896).\n  * GTK3 X11 redraws are not coalesced (9.2.0897).\n  * printing support is lacking (9.2.0898).\n  * command output temporary files may collide (9.2.0899).\n  * FocusGained still triggered when closing dialog (9.2.0900).\n  * textprop: wrong cursor line with truncated virtual text (9.2.0901).\n  * Vim9: iterating over a tuple leaks memory (9.2.0902).\n  * Vim9: cannot use an exported function of an autoload import (9.2.0903).\n  * \"zb\" scrolls incorrectly with cursor just above fold (9.2.0904).\n  * MS-Windows: ghost cursor with ligatures (9.2.0905).\n  * slow transstr() with long strings (9.2.0906).\n  * popup: virtual text is not redrawn when a text property changes (9.2.0907).\n  * cannot use a {} block in a nested :autocmd (9.2.0908).\n  * insert completion is slow to collect many matches (9.2.0909).\n  * runtime(vim): update syntax, contain Ex commands (9.2.0910).\n  * makefiles do not build hardcopy_postscript.c (9.2.0911).\n  * hardcopy: prototypes are hand-written instead of generated (9.2.0912).\n  * statusline: cell below the vertical separator keeps the old highlight (9.2.0913).\n  * diff: undo after :diffget into an empty buffer leaves a line behind (9.2.0914).\n  * tests: two terminal tests in test_popupwin fail on FreeBSD (9.2.0915).\n  * configure: honor `--disable-hardcopy-pango` with GTK UI (9.2.0916).\n  * :quitall not allowed in the command-line window (9.2.0917).\n  * screen: fill char with a zero low byte is stored as a NUL cell (9.2.0918).\n  * screen: the wrong array is copied into ScreenCols on a resize (9.2.0919).\n  * filetype: json-ld files are not recognized (9.2.0920).\n  * test: terminal tests fail on FreeBSD (9.2.0921).\n  * Wayland: modeless selection not redrawn (9.2.0922).\n  * tabpage: closing a tab page loses the alternate tab page (9.2.0923).\n  * tests: Test_termwinscroll() fails on FreeBSD (9.2.0924).\n  * crash when getcompletiontype() gets a NULL string (9.2.0925).\n  * filetype: business Central files are not recognized (9.2.0926).\n  * curswant not set on 8g8 (9.2.0927).\n  * MinGW: tests hang when Vim is built with coverage enabled (9.2.0928).\n  * incorrect completion for 'pumopt' and 'pumborder' (9.2.0929).\n  * floating point exception when displaying pum (9.2.0930).\n  * the GTK4 GUI is still experimental and untested by CI (9.2.0931).\n  * NFA engine fallback can double free the compiled program (9.2.0932).\n  * u_read_undo() leaks the file name when the undo file owner differs (9.2.0933).\n  * filetype: hlsl files are not recognized (9.2.0934).\n  * reading an undo file is slow with many undo headers (9.2.0935).\n  * stringifying a list or dict can free the item being iterated (9.2.0936).\n  * sort() with a numeric option converts each item on every comparison (9.2.0937).\n  * cursorbind: cursor in the other window is not updated after undo (9.2.0938).\n  * mbyte: wrong cell count for an overlong UTF-8 sequence (9.2.0939).\n  * GTK4: columns are lost when a scrollbar appears (9.2.0940).\n  * tests: clipboard tests fail in the GUI when the terminal has no clipboard (9.2.0941).\n  * test: test_mksession_winpos() fails on GTK4 UI (9.2.0942).\n  * test: test_hardcopy fails on GTK4 UI (9.2.0943).\n  * test: tests fail when checking for GTK4 feature (9.2.0944).\n  * sort() with a numeric option can be improved (9.2.0945).\n  * GTK2/3: mouse move starts Visual selection after a dialog (9.2.0946).\n  * GTK4: screen is cleared when moving the mouse after startup (9.2.0947).\n  * GTK4: mouse move starts Visual selection after a dialog (9.2.0948).\n  * GDK_KEY_VoidSymbol might be undefined (9.2.0949).\n  * transstr() can be improved (after 9.2.0906) (9.2.0950).\n  * GTK3: cursor does no longer blink (9.2.0951).\n  * locking a container while stringifying can be improved (9.2.0952).\n  * insert completion code can be improved (9.2.0953).\n  * u_read_undo() can be improved (after 9.2.0935) (9.2.0954).\n  * tests: terminal tests are flaky (9.2.0955).\n  * GTK4: crash when the window is resized while redrawing (9.2.0956).\n  * filetype: ArgoCD config file is not recognized (9.2.0957).\n- Allow `wrap` and `linebreak` to be set from a modeline (bsc#1268162).\n- Point `SYS_VIMRC_FILE` at `$VIMRUNTIME/suse.vimrc` rather than `/etc/vimrc`, which we no longer own (bsc#1268162).\n- Update `suse.vimrc`: source `/etc/vimrc` at the end of the file, so that a local system vimrc still overrides the\n  distribution defaults.\n- Guard `suse.vimrc` against re-entry to prevent an infinite sourcing loop (bsc#1271684).\n","status":"published","published":"2026-08-28T08:29:35Z","modified":"2026-09-29T18:23:08.354948003Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3677-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\n- CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).\n- CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).\n- CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution\n  (bsc#1275016).\n- CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution\n  (bsc#1275015).\n- CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).\n- CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).\n- CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).\n- CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).\n\nChanges for vim:\n\n- Updated to version 9.2.0957.\n * tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).\n * tests: missing cleanup in test_mksession.vim (9.2.0782).\n * tests: personal spell files leak into later tests (9.2.0783).\n * crash when borrowing statusline highlight in silent Ex mode (9.2.0784).\n * WinResized not triggered when the whole Vim is resized (9.2.0785).\n * filetype: containerfile is not recognized (9.2.0786).\n * regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).\n * filetype: hip files are not recognized (9.2.0788).\n * 'statuslineopt' status line too high after a window is minimized (9.2.0789).\n * 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).\n * wincol() counts from right side for 'rightleft' (9.2.0791).\n * runtime(netrw): explore without optional dir broken (9.2.0792).\n * if session restored a tiny window, restore fails (9.2.0793).\n * extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).\n * popup menu shadow is not cleared when the menu shrinks (9.2.0795).\n * Visual block reselection wrong with 'virtualedit' (9.2.0796).\n * memory leak in get_qfline_items() on alloc failure (9.2.0797).\n * memory leak in compile_expr6() on alloc failure (9.2.0798).\n * memory leak in compile_def_function_body() on alloc failure (9.2.0799).\n * memory leak in call_func() on alloc failure (9.2.0800).\n * memory leak in f_getreginfo() on alloc failure (9.2.0801).\n * memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).\n * memory leak on alloc failure with taglist/gettagstack() (9.2.0803).\n * wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).\n * screenpos() 'curscol' is wrong with 'rightleft' (9.2.0805).\n * 'showcmd' may show internal command keys (9.2.0806).\n * MS-Windows: ellipsis character is garbled (9.2.0807).\n * getregionpos: double-free on alloc failure (9.2.0808).\n * getframelayout() uses wrong function to free lists (9.2.0809).\n * add_llist_tags() uses wrong function to free dict (9.2.0810).\n * mksession writes terminal command unquoted (9.2.0811).\n * :argdelete with pattern leads to wrong argidx() (9.2.0812).\n * dict_add_func() may corrupt funcref count on failure (9.2.0813).\n * Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).\n * deeply nested regexp patterns may cause stack overflow (9.2.0815).\n * GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).\n * crash when building a stacktrace during an autocommand (9.2.0817).\n * tests: client-server test fails without X11 server (9.2.0818).\n * MS-Windows: sixel image shown as raw text in the console (9.2.0819).\n * GUI: hidden popup image is displayed and not erased (9.2.0820).\n * filetype: msmtp system-wide rc file not detected (9.2.0821).\n * GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).\n * tests: Test_clientserver_servlist_list may fail (9.2.0823).\n * Makefile: make tags depends on configure (9.2.0824).\n * regexp: submatch in a look-behind is empty with the NFA engine (9.2.0825).\n * highlighting for broken terminals can be improved (9.2.0826).\n * :startinsert enters Insert mode in a non-modifiable buffer (9.2.0827).\n * GTK4: hardware rendering can be improved (9.2.0828).\n * sessions do not preserve script version for expression options (9.2.0829).\n * the completion menu is not used on terminals without colors (9.2.0830).\n * diff highlighting hard to read with syntax enabled (9.2.0831).\n * socketserver: remote commands can be processed in reverse order (9.2.0832).\n * GTK4: menu mnemonics do not work properly (9.2.0833).\n * cleared last search pattern is restored from viminfo (9.2.0834).\n * features in version.c are not sorted (9.2.0835).\n * filetype: .git-blame-ignore-revs file is not recognized (9.2.0836).\n * using wrong colors in hl_blend_attr() (9.2.0837).\n * searchcount() returns wrong cached maxcount (9.2.0838).\n * [security]: arbitrary code execution via keyword lookup (9.2.0839).\n * [security]: code injection in netrw via bookmarks (9.2.0840).\n * [security]: heap overflow when adding \u003e 65535 text properties (9.2.0841).\n * [security]: stack buffer overflow in socket server (9.2.0842).\n * [security]: popup: opacity mask indexed out of bounds (9.2.0843).\n * [security]: use-after-free on json decode error (9.2.0844).\n * [security]: arbitrary Ex command execution during C omni-completion (9.2.0845).\n * [security]: heap buffer overflow in set_sofo() (9.2.0846).\n * [security]: vimball: code execution via .VimballRecord file (9.2.0847).\n * tagfunc 'cmd' with a generic Ex command corrupts the tag entry (9.2.0848).\n * filetype: osquery config files are not recognized (9.2.0849).\n * MS-Windows: commands from a client can be lost (9.2.0850).\n * focus autocommands triggered inconsistently (9.2.0851).\n * GTK: ligatures not correctly displayed (9.2.0852).\n * popup: popup images do not support scaling (9.2.0853).\n * memory leak when reading a spell file with SN_SAL and SN_SOFO (9.2.0854).\n * 'showcmd' not redrawn with empty mapping triggered on timeout (9.2.0855).\n * GTK4: undercurl rendering is inefficient (9.2.0856).\n * popup: opacity popup over a terminal is not cleared when closed (9.2.0857).\n * MS-Windows GUI: white flash when VimEnter is slow (9.2.0858).\n * GTK2: link error (9.2.0859).\n * filetype: xilinx design constraint files are not recognized (9.2.0860).\n * GTK4: bleed region updates in jumps (9.2.0861).\n * missing test change from v9.2.0857 (9.2.0862).\n * MS-Windows GUI: window contents can be missing when VimEnter is slow (9.2.0863).\n * using some dead code in Wayland feature (9.2.0864).\n * GTK4: non-hardware accelerated UI is too slow (9.2.0865).\n * MS-Windows: ':language messages' only works once (9.2.0866).\n * MS-Windows: messages are not in the display language (9.2.0867).\n * GTK: window Manager hint prevents giving focus to dialog (9.2.0868).\n * buf_copy_options() can lose the P_INSECURE flag (9.2.0869).\n * filetype: marko files are not recognized (9.2.0870).\n * screen line is lost when splitting a 'winfixheight' window (9.2.0871).\n * popup with opacity does not use the font of the highlight group (9.2.0872).\n * :redrawstatus does not update the ruler of the last window (9.2.0873).\n * fold size is compared against 'foldminlines' of the wrong window (9.2.0874).\n * GTK4: GUI does not support command-line arguments (9.2.0875).\n * GTK4: compile error with disabled netbeans feat (9.2.0876).\n * Vim9: crash when a closure assigns to a variable declared in a loop (9.2.0877).\n * Vim9: cannot use a script variable of an enclosing block in a lambda (9.2.0878).\n * popup: 'maxwidth' is not respected when 'wrap' is off (9.2.0879).\n * scroll: window scrolls when using the autocommand window (9.2.0880).\n * 'smoothscroll' position is lost when the window height changes (9.2.0881).\n * :bwipe crashes if WinLeave wipes all other buffers (9.2.0882).\n * scroll: 'smoothscroll' position is lost when using '|' (9.2.0883).\n * scroll: unreachable 'smoothscroll' code in cursor_correct() (9.2.0884).\n * scroll: 'smoothscroll' position is lost when the window is squeezed (9.2.0885).\n * :set completion works for an invalid sub-option name (9.2.0886).\n * scroll: jump-scrolling when moving the cursor onto a wrapping line (9.2.0887).\n * mapping: modifier is not recognized after a partial mapping (9.2.0888).\n * VMS: spurious 'INVALID DECC FEATURE VALUE' message at every startup (9.2.0889).\n * test: test for patch v9.2.0888 can be clarified (9.2.0890).\n * MS-Windows: filename-modifier ':8:t' causes underflow (9.2.0891).\n * highlight: wrong column highlighted with 'cursorcolumn' (9.2.0892).\n * MS-Windows: '*.vim' also matches files with a longer extension (9.2.0893).\n * filetype: ed script files not recognised (9.2.0894).\n * test: Test_aucmd_win_scroll_multibyte() is flaky in the GUI (9.2.0895).\n * scroll: 'smoothscroll' position is lost when splitting a window (9.2.0896).\n * GTK3 X11 redraws are not coalesced (9.2.0897).\n * printing support is lacking (9.2.0898).\n * command output temporary files may collide (9.2.0899).\n * FocusGained still triggered when closing dialog (9.2.0900).\n * textprop: wrong cursor line with truncated virtual text (9.2.0901).\n * Vim9: iterating over a tuple leaks memory (9.2.0902).\n * Vim9: cannot use an exported function of an autoload import (9.2.0903).\n * 'zb' scrolls incorrectly with cursor just above fold (9.2.0904).\n * MS-Windows: ghost cursor with ligatures (9.2.0905).\n * slow transstr() with long strings (9.2.0906).\n * popup: virtual text is not redrawn when a text property changes (9.2.0907).\n * cannot use a {} block in a nested :autocmd (9.2.0908).\n * insert completion is slow to collect many matches (9.2.0909).\n * runtime(vim): update syntax, contain Ex commands (9.2.0910).\n * makefiles do not build hardcopy_postscript.c (9.2.0911).\n * hardcopy: prototypes are hand-written instead of generated (9.2.0912).\n * statusline: cell below the vertical separator keeps the old highlight (9.2.0913).\n * diff: undo after :diffget into an empty buffer leaves a line behind (9.2.0914).\n * tests: two terminal tests in test_popupwin fail on FreeBSD (9.2.0915).\n * configure: honor `--disable-hardcopy-pango` with GTK UI (9.2.0916).\n * :quitall not allowed in the command-line window (9.2.0917).\n * screen: fill char with a zero low byte is stored as a NUL cell (9.2.0918).\n * screen: the wrong array is copied into ScreenCols on a resize (9.2.0919).\n * filetype: json-ld files are not recognized (9.2.0920).\n * test: terminal tests fail on FreeBSD (9.2.0921).\n * Wayland: modeless selection not redrawn (9.2.0922).\n * tabpage: closing a tab page loses the alternate tab page (9.2.0923).\n * tests: Test_termwinscroll() fails on FreeBSD (9.2.0924).\n * crash when getcompletiontype() gets a NULL string (9.2.0925).\n * filetype: business Central files are not recognized (9.2.0926).\n * curswant not set on 8g8 (9.2.0927).\n * MinGW: tests hang when Vim is built with coverage enabled (9.2.0928).\n * incorrect completion for 'pumopt' and 'pumborder' (9.2.0929).\n * floating point exception when displaying pum (9.2.0930).\n * the GTK4 GUI is still experimental and untested by CI (9.2.0931).\n * NFA engine fallback can double free the compiled program (9.2.0932).\n * u_read_undo() leaks the file name when the undo file owner differs (9.2.0933).\n * filetype: hlsl files are not recognized (9.2.0934).\n * reading an undo file is slow with many undo headers (9.2.0935).\n * stringifying a list or dict can free the item being iterated (9.2.0936).\n * sort() with a numeric option converts each item on every comparison (9.2.0937).\n * cursorbind: cursor in the other window is not updated after undo (9.2.0938).\n * mbyte: wrong cell count for an overlong UTF-8 sequence (9.2.0939).\n * GTK4: columns are lost when a scrollbar appears (9.2.0940).\n * tests: clipboard tests fail in the GUI when the terminal has no clipboard (9.2.0941).\n * test: test_mksession_winpos() fails on GTK4 UI (9.2.0942).\n * test: test_hardcopy fails on GTK4 UI (9.2.0943).\n * test: tests fail when checking for GTK4 feature (9.2.0944).\n * sort() with a numeric option can be improved (9.2.0945).\n * GTK2/3: mouse move starts Visual selection after a dialog (9.2.0946).\n * GTK4: screen is cleared when moving the mouse after startup (9.2.0947).\n * GTK4: mouse move starts Visual selection after a dialog (9.2.0948).\n * GDK_KEY_VoidSymbol might be undefined (9.2.0949).\n * transstr() can be improved (after 9.2.0906) (9.2.0950).\n * GTK3: cursor does no longer blink (9.2.0951).\n * locking a container while stringifying can be improved (9.2.0952).\n * insert completion code can be improved (9.2.0953).\n * u_read_undo() can be improved (after 9.2.0935) (9.2.0954).\n * tests: terminal tests are flaky (9.2.0955).\n * GTK4: crash when the window is resized while redrawing (9.2.0956).\n * filetype: ArgoCD config file is not recognized (9.2.0957).\n","status":"published","published":"2026-08-21T14:19:01Z","modified":"2026-08-26T18:23:32.604330585Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3679-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\n- CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).\n- CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).\n- CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution\n  (bsc#1275016).\n- CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution\n  (bsc#1275015).\n- CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).\n- CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).\n- CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).\n- CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).\n\nChanges for vim:\n\n- Updated to version 9.2.0957.\n * tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).\n * tests: missing cleanup in test_mksession.vim (9.2.0782).\n * tests: personal spell files leak into later tests (9.2.0783).\n * crash when borrowing statusline highlight in silent Ex mode (9.2.0784).\n * WinResized not triggered when the whole Vim is resized (9.2.0785).\n * filetype: containerfile is not recognized (9.2.0786).\n * regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).\n * filetype: hip files are not recognized (9.2.0788).\n * 'statuslineopt' status line too high after a window is minimized (9.2.0789).\n * 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).\n * wincol() counts from right side for 'rightleft' (9.2.0791).\n * runtime(netrw): explore without optional dir broken (9.2.0792).\n * if session restored a tiny window, restore fails (9.2.0793).\n * extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).\n * popup menu shadow is not cleared when the menu shrinks (9.2.0795).\n * Visual block reselection wrong with 'virtualedit' (9.2.0796).\n * memory leak in get_qfline_items() on alloc failure (9.2.0797).\n * memory leak in compile_expr6() on alloc failure (9.2.0798).\n * memory leak in compile_def_function_body() on alloc failure (9.2.0799).\n * memory leak in call_func() on alloc failure (9.2.0800).\n * memory leak in f_getreginfo() on alloc failure (9.2.0801).\n * memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).\n * memory leak on alloc failure with taglist/gettagstack() (9.2.0803).\n * wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).\n * screenpos() 'curscol' is wrong with 'rightleft' (9.2.0805).\n * 'showcmd' may show internal command keys (9.2.0806).\n * MS-Windows: ellipsis character is garbled (9.2.0807).\n * getregionpos: double-free on alloc failure (9.2.0808).\n * getframelayout() uses wrong function to free lists (9.2.0809).\n * add_llist_tags() uses wrong function to free dict (9.2.0810).\n * mksession writes terminal command unquoted (9.2.0811).\n * :argdelete with pattern leads to wrong argidx() (9.2.0812).\n * dict_add_func() may corrupt funcref count on failure (9.2.0813).\n * Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).\n * deeply nested regexp patterns may cause stack overflow (9.2.0815).\n * GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).\n * crash when building a stacktrace during an autocommand (9.2.0817).\n * tests: client-server test fails without X11 server (9.2.0818).\n * MS-Windows: sixel image shown as raw text in the console (9.2.0819).\n * GUI: hidden popup image is displayed and not erased (9.2.0820).\n * filetype: msmtp system-wide rc file not detected (9.2.0821).\n * GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).\n * tests: Test_clientserver_servlist_list may fail (9.2.0823).\n * Makefile: make tags depends on configure (9.2.0824).\n * regexp: submatch in a look-behind is empty with the NFA engine (9.2.0825).\n * highlighting for broken terminals can be improved (9.2.0826).\n * :startinsert enters Insert mode in a non-modifiable buffer (9.2.0827).\n * GTK4: hardware rendering can be improved (9.2.0828).\n * sessions do not preserve script version for expression options (9.2.0829).\n * the completion menu is not used on terminals without colors (9.2.0830).\n * diff highlighting hard to read with syntax enabled (9.2.0831).\n * socketserver: remote commands can be processed in reverse order (9.2.0832).\n * GTK4: menu mnemonics do not work properly (9.2.0833).\n * cleared last search pattern is restored from viminfo (9.2.0834).\n * features in version.c are not sorted (9.2.0835).\n * filetype: .git-blame-ignore-revs file is not recognized (9.2.0836).\n * using wrong colors in hl_blend_attr() (9.2.0837).\n * searchcount() returns wrong cached maxcount (9.2.0838).\n * [security]: arbitrary code execution via keyword lookup (9.2.0839).\n * [security]: code injection in netrw via bookmarks (9.2.0840).\n * [security]: heap overflow when adding \u003e 65535 text properties (9.2.0841).\n * [security]: stack buffer overflow in socket server (9.2.0842).\n * [security]: popup: opacity mask indexed out of bounds (9.2.0843).\n * [security]: use-after-free on json decode error (9.2.0844).\n * [security]: arbitrary Ex command execution during C omni-completion (9.2.0845).\n * [security]: heap buffer overflow in set_sofo() (9.2.0846).\n * [security]: vimball: code execution via .VimballRecord file (9.2.0847).\n * tagfunc 'cmd' with a generic Ex command corrupts the tag entry (9.2.0848).\n * filetype: osquery config files are not recognized (9.2.0849).\n * MS-Windows: commands from a client can be lost (9.2.0850).\n * focus autocommands triggered inconsistently (9.2.0851).\n * GTK: ligatures not correctly displayed (9.2.0852).\n * popup: popup images do not support scaling (9.2.0853).\n * memory leak when reading a spell file with SN_SAL and SN_SOFO (9.2.0854).\n * 'showcmd' not redrawn with empty mapping triggered on timeout (9.2.0855).\n * GTK4: undercurl rendering is inefficient (9.2.0856).\n * popup: opacity popup over a terminal is not cleared when closed (9.2.0857).\n * MS-Windows GUI: white flash when VimEnter is slow (9.2.0858).\n * GTK2: link error (9.2.0859).\n * filetype: xilinx design constraint files are not recognized (9.2.0860).\n * GTK4: bleed region updates in jumps (9.2.0861).\n * missing test change from v9.2.0857 (9.2.0862).\n * MS-Windows GUI: window contents can be missing when VimEnter is slow (9.2.0863).\n * using some dead code in Wayland feature (9.2.0864).\n * GTK4: non-hardware accelerated UI is too slow (9.2.0865).\n * MS-Windows: ':language messages' only works once (9.2.0866).\n * MS-Windows: messages are not in the display language (9.2.0867).\n * GTK: window Manager hint prevents giving focus to dialog (9.2.0868).\n * buf_copy_options() can lose the P_INSECURE flag (9.2.0869).\n * filetype: marko files are not recognized (9.2.0870).\n * screen line is lost when splitting a 'winfixheight' window (9.2.0871).\n * popup with opacity does not use the font of the highlight group (9.2.0872).\n * :redrawstatus does not update the ruler of the last window (9.2.0873).\n * fold size is compared against 'foldminlines' of the wrong window (9.2.0874).\n * GTK4: GUI does not support command-line arguments (9.2.0875).\n * GTK4: compile error with disabled netbeans feat (9.2.0876).\n * Vim9: crash when a closure assigns to a variable declared in a loop (9.2.0877).\n * Vim9: cannot use a script variable of an enclosing block in a lambda (9.2.0878).\n * popup: 'maxwidth' is not respected when 'wrap' is off (9.2.0879).\n * scroll: window scrolls when using the autocommand window (9.2.0880).\n * 'smoothscroll' position is lost when the window height changes (9.2.0881).\n * :bwipe crashes if WinLeave wipes all other buffers (9.2.0882).\n * scroll: 'smoothscroll' position is lost when using '|' (9.2.0883).\n * scroll: unreachable 'smoothscroll' code in cursor_correct() (9.2.0884).\n * scroll: 'smoothscroll' position is lost when the window is squeezed (9.2.0885).\n * :set completion works for an invalid sub-option name (9.2.0886).\n * scroll: jump-scrolling when moving the cursor onto a wrapping line (9.2.0887).\n * mapping: modifier is not recognized after a partial mapping (9.2.0888).\n * VMS: spurious 'INVALID DECC FEATURE VALUE' message at every startup (9.2.0889).\n * test: test for patch v9.2.0888 can be clarified (9.2.0890).\n * MS-Windows: filename-modifier ':8:t' causes underflow (9.2.0891).\n * highlight: wrong column highlighted with 'cursorcolumn' (9.2.0892).\n * MS-Windows: '*.vim' also matches files with a longer extension (9.2.0893).\n * filetype: ed script files not recognised (9.2.0894).\n * test: Test_aucmd_win_scroll_multibyte() is flaky in the GUI (9.2.0895).\n * scroll: 'smoothscroll' position is lost when splitting a window (9.2.0896).\n * GTK3 X11 redraws are not coalesced (9.2.0897).\n * printing support is lacking (9.2.0898).\n * command output temporary files may collide (9.2.0899).\n * FocusGained still triggered when closing dialog (9.2.0900).\n * textprop: wrong cursor line with truncated virtual text (9.2.0901).\n * Vim9: iterating over a tuple leaks memory (9.2.0902).\n * Vim9: cannot use an exported function of an autoload import (9.2.0903).\n * 'zb' scrolls incorrectly with cursor just above fold (9.2.0904).\n * MS-Windows: ghost cursor with ligatures (9.2.0905).\n * slow transstr() with long strings (9.2.0906).\n * popup: virtual text is not redrawn when a text property changes (9.2.0907).\n * cannot use a {} block in a nested :autocmd (9.2.0908).\n * insert completion is slow to collect many matches (9.2.0909).\n * runtime(vim): update syntax, contain Ex commands (9.2.0910).\n * makefiles do not build hardcopy_postscript.c (9.2.0911).\n * hardcopy: prototypes are hand-written instead of generated (9.2.0912).\n * statusline: cell below the vertical separator keeps the old highlight (9.2.0913).\n * diff: undo after :diffget into an empty buffer leaves a line behind (9.2.0914).\n * tests: two terminal tests in test_popupwin fail on FreeBSD (9.2.0915).\n * configure: honor `--disable-hardcopy-pango` with GTK UI (9.2.0916).\n * :quitall not allowed in the command-line window (9.2.0917).\n * screen: fill char with a zero low byte is stored as a NUL cell (9.2.0918).\n * screen: the wrong array is copied into ScreenCols on a resize (9.2.0919).\n * filetype: json-ld files are not recognized (9.2.0920).\n * test: terminal tests fail on FreeBSD (9.2.0921).\n * Wayland: modeless selection not redrawn (9.2.0922).\n * tabpage: closing a tab page loses the alternate tab page (9.2.0923).\n * tests: Test_termwinscroll() fails on FreeBSD (9.2.0924).\n * crash when getcompletiontype() gets a NULL string (9.2.0925).\n * filetype: business Central files are not recognized (9.2.0926).\n * curswant not set on 8g8 (9.2.0927).\n * MinGW: tests hang when Vim is built with coverage enabled (9.2.0928).\n * incorrect completion for 'pumopt' and 'pumborder' (9.2.0929).\n * floating point exception when displaying pum (9.2.0930).\n * the GTK4 GUI is still experimental and untested by CI (9.2.0931).\n * NFA engine fallback can double free the compiled program (9.2.0932).\n * u_read_undo() leaks the file name when the undo file owner differs (9.2.0933).\n * filetype: hlsl files are not recognized (9.2.0934).\n * reading an undo file is slow with many undo headers (9.2.0935).\n * stringifying a list or dict can free the item being iterated (9.2.0936).\n * sort() with a numeric option converts each item on every comparison (9.2.0937).\n * cursorbind: cursor in the other window is not updated after undo (9.2.0938).\n * mbyte: wrong cell count for an overlong UTF-8 sequence (9.2.0939).\n * GTK4: columns are lost when a scrollbar appears (9.2.0940).\n * tests: clipboard tests fail in the GUI when the terminal has no clipboard (9.2.0941).\n * test: test_mksession_winpos() fails on GTK4 UI (9.2.0942).\n * test: test_hardcopy fails on GTK4 UI (9.2.0943).\n * test: tests fail when checking for GTK4 feature (9.2.0944).\n * sort() with a numeric option can be improved (9.2.0945).\n * GTK2/3: mouse move starts Visual selection after a dialog (9.2.0946).\n * GTK4: screen is cleared when moving the mouse after startup (9.2.0947).\n * GTK4: mouse move starts Visual selection after a dialog (9.2.0948).\n * GDK_KEY_VoidSymbol might be undefined (9.2.0949).\n * transstr() can be improved (after 9.2.0906) (9.2.0950).\n * GTK3: cursor does no longer blink (9.2.0951).\n * locking a container while stringifying can be improved (9.2.0952).\n * insert completion code can be improved (9.2.0953).\n * u_read_undo() can be improved (after 9.2.0935) (9.2.0954).\n * tests: terminal tests are flaky (9.2.0955).\n * GTK4: crash when the window is resized while redrawing (9.2.0956).\n * filetype: ArgoCD config file is not recognized (9.2.0957).\n","status":"published","published":"2026-08-21T14:20:23Z","modified":"2026-08-22T09:45:04.230940556Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3680-1","title":"Security update for vim","description":"This update for vim fixes the following issues:\n\n- CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).\n- CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).\n- CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution\n  (bsc#1275016).\n- CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution\n  (bsc#1275015).\n- CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).\n- CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).\n- CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).\n- CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).\n\nChanges for vim:\n\n- Updated to version 9.2.0957.\n * tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).\n * tests: missing cleanup in test_mksession.vim (9.2.0782).\n * tests: personal spell files leak into later tests (9.2.0783).\n * crash when borrowing statusline highlight in silent Ex mode (9.2.0784).\n * WinResized not triggered when the whole Vim is resized (9.2.0785).\n * filetype: containerfile is not recognized (9.2.0786).\n * regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).\n * filetype: hip files are not recognized (9.2.0788).\n * 'statuslineopt' status line too high after a window is minimized (9.2.0789).\n * 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).\n * wincol() counts from right side for 'rightleft' (9.2.0791).\n * runtime(netrw): explore without optional dir broken (9.2.0792).\n * if session restored a tiny window, restore fails (9.2.0793).\n * extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).\n * popup menu shadow is not cleared when the menu shrinks (9.2.0795).\n * Visual block reselection wrong with 'virtualedit' (9.2.0796).\n * memory leak in get_qfline_items() on alloc failure (9.2.0797).\n * memory leak in compile_expr6() on alloc failure (9.2.0798).\n * memory leak in compile_def_function_body() on alloc failure (9.2.0799).\n * memory leak in call_func() on alloc failure (9.2.0800).\n * memory leak in f_getreginfo() on alloc failure (9.2.0801).\n * memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).\n * memory leak on alloc failure with taglist/gettagstack() (9.2.0803).\n * wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).\n * screenpos() 'curscol' is wrong with 'rightleft' (9.2.0805).\n * 'showcmd' may show internal command keys (9.2.0806).\n * MS-Windows: ellipsis character is garbled (9.2.0807).\n * getregionpos: double-free on alloc failure (9.2.0808).\n * getframelayout() uses wrong function to free lists (9.2.0809).\n * add_llist_tags() uses wrong function to free dict (9.2.0810).\n * mksession writes terminal command unquoted (9.2.0811).\n * :argdelete with pattern leads to wrong argidx() (9.2.0812).\n * dict_add_func() may corrupt funcref count on failure (9.2.0813).\n * Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).\n * deeply nested regexp patterns may cause stack overflow (9.2.0815).\n * GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).\n * crash when building a stacktrace during an autocommand (9.2.0817).\n * tests: client-server test fails without X11 server (9.2.0818).\n * MS-Windows: sixel image shown as raw text in the console (9.2.0819).\n * GUI: hidden popup image is displayed and not erased (9.2.0820).\n * filetype: msmtp system-wide rc file not detected (9.2.0821).\n * GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).\n * tests: Test_clientserver_servlist_list may fail (9.2.0823).\n * Makefile: make tags depends on configure (9.2.0824).\n * regexp: submatch in a look-behind is empty with the NFA engine (9.2.0825).\n * highlighting for broken terminals can be improved (9.2.0826).\n * :startinsert enters Insert mode in a non-modifiable buffer (9.2.0827).\n * GTK4: hardware rendering can be improved (9.2.0828).\n * sessions do not preserve script version for expression options (9.2.0829).\n * the completion menu is not used on terminals without colors (9.2.0830).\n * diff highlighting hard to read with syntax enabled (9.2.0831).\n * socketserver: remote commands can be processed in reverse order (9.2.0832).\n * GTK4: menu mnemonics do not work properly (9.2.0833).\n * cleared last search pattern is restored from viminfo (9.2.0834).\n * features in version.c are not sorted (9.2.0835).\n * filetype: .git-blame-ignore-revs file is not recognized (9.2.0836).\n * using wrong colors in hl_blend_attr() (9.2.0837).\n * searchcount() returns wrong cached maxcount (9.2.0838).\n * [security]: arbitrary code execution via keyword lookup (9.2.0839).\n * [security]: code injection in netrw via bookmarks (9.2.0840).\n * [security]: heap overflow when adding \u003e 65535 text properties (9.2.0841).\n * [security]: stack buffer overflow in socket server (9.2.0842).\n * [security]: popup: opacity mask indexed out of bounds (9.2.0843).\n * [security]: use-after-free on json decode error (9.2.0844).\n * [security]: arbitrary Ex command execution during C omni-completion (9.2.0845).\n * [security]: heap buffer overflow in set_sofo() (9.2.0846).\n * [security]: vimball: code execution via .VimballRecord file (9.2.0847).\n * tagfunc 'cmd' with a generic Ex command corrupts the tag entry (9.2.0848).\n * filetype: osquery config files are not recognized (9.2.0849).\n * MS-Windows: commands from a client can be lost (9.2.0850).\n * focus autocommands triggered inconsistently (9.2.0851).\n * GTK: ligatures not correctly displayed (9.2.0852).\n * popup: popup images do not support scaling (9.2.0853).\n * memory leak when reading a spell file with SN_SAL and SN_SOFO (9.2.0854).\n * 'showcmd' not redrawn with empty mapping triggered on timeout (9.2.0855).\n * GTK4: undercurl rendering is inefficient (9.2.0856).\n * popup: opacity popup over a terminal is not cleared when closed (9.2.0857).\n * MS-Windows GUI: white flash when VimEnter is slow (9.2.0858).\n * GTK2: link error (9.2.0859).\n * filetype: xilinx design constraint files are not recognized (9.2.0860).\n * GTK4: bleed region updates in jumps (9.2.0861).\n * missing test change from v9.2.0857 (9.2.0862).\n * MS-Windows GUI: window contents can be missing when VimEnter is slow (9.2.0863).\n * using some dead code in Wayland feature (9.2.0864).\n * GTK4: non-hardware accelerated UI is too slow (9.2.0865).\n * MS-Windows: ':language messages' only works once (9.2.0866).\n * MS-Windows: messages are not in the display language (9.2.0867).\n * GTK: window Manager hint prevents giving focus to dialog (9.2.0868).\n * buf_copy_options() can lose the P_INSECURE flag (9.2.0869).\n * filetype: marko files are not recognized (9.2.0870).\n * screen line is lost when splitting a 'winfixheight' window (9.2.0871).\n * popup with opacity does not use the font of the highlight group (9.2.0872).\n * :redrawstatus does not update the ruler of the last window (9.2.0873).\n * fold size is compared against 'foldminlines' of the wrong window (9.2.0874).\n * GTK4: GUI does not support command-line arguments (9.2.0875).\n * GTK4: compile error with disabled netbeans feat (9.2.0876).\n * Vim9: crash when a closure assigns to a variable declared in a loop (9.2.0877).\n * Vim9: cannot use a script variable of an enclosing block in a lambda (9.2.0878).\n * popup: 'maxwidth' is not respected when 'wrap' is off (9.2.0879).\n * scroll: window scrolls when using the autocommand window (9.2.0880).\n * 'smoothscroll' position is lost when the window height changes (9.2.0881).\n * :bwipe crashes if WinLeave wipes all other buffers (9.2.0882).\n * scroll: 'smoothscroll' position is lost when using '|' (9.2.0883).\n * scroll: unreachable 'smoothscroll' code in cursor_correct() (9.2.0884).\n * scroll: 'smoothscroll' position is lost when the window is squeezed (9.2.0885).\n * :set completion works for an invalid sub-option name (9.2.0886).\n * scroll: jump-scrolling when moving the cursor onto a wrapping line (9.2.0887).\n * mapping: modifier is not recognized after a partial mapping (9.2.0888).\n * VMS: spurious 'INVALID DECC FEATURE VALUE' message at every startup (9.2.0889).\n * test: test for patch v9.2.0888 can be clarified (9.2.0890).\n * MS-Windows: filename-modifier ':8:t' causes underflow (9.2.0891).\n * highlight: wrong column highlighted with 'cursorcolumn' (9.2.0892).\n * MS-Windows: '*.vim' also matches files with a longer extension (9.2.0893).\n * filetype: ed script files not recognised (9.2.0894).\n * test: Test_aucmd_win_scroll_multibyte() is flaky in the GUI (9.2.0895).\n * scroll: 'smoothscroll' position is lost when splitting a window (9.2.0896).\n * GTK3 X11 redraws are not coalesced (9.2.0897).\n * printing support is lacking (9.2.0898).\n * command output temporary files may collide (9.2.0899).\n * FocusGained still triggered when closing dialog (9.2.0900).\n * textprop: wrong cursor line with truncated virtual text (9.2.0901).\n * Vim9: iterating over a tuple leaks memory (9.2.0902).\n * Vim9: cannot use an exported function of an autoload import (9.2.0903).\n * 'zb' scrolls incorrectly with cursor just above fold (9.2.0904).\n * MS-Windows: ghost cursor with ligatures (9.2.0905).\n * slow transstr() with long strings (9.2.0906).\n * popup: virtual text is not redrawn when a text property changes (9.2.0907).\n * cannot use a {} block in a nested :autocmd (9.2.0908).\n * insert completion is slow to collect many matches (9.2.0909).\n * runtime(vim): update syntax, contain Ex commands (9.2.0910).\n * makefiles do not build hardcopy_postscript.c (9.2.0911).\n * hardcopy: prototypes are hand-written instead of generated (9.2.0912).\n * statusline: cell below the vertical separator keeps the old highlight (9.2.0913).\n * diff: undo after :diffget into an empty buffer leaves a line behind (9.2.0914).\n * tests: two terminal tests in test_popupwin fail on FreeBSD (9.2.0915).\n * configure: honor `--disable-hardcopy-pango` with GTK UI (9.2.0916).\n * :quitall not allowed in the command-line window (9.2.0917).\n * screen: fill char with a zero low byte is stored as a NUL cell (9.2.0918).\n * screen: the wrong array is copied into ScreenCols on a resize (9.2.0919).\n * filetype: json-ld files are not recognized (9.2.0920).\n * test: terminal tests fail on FreeBSD (9.2.0921).\n * Wayland: modeless selection not redrawn (9.2.0922).\n * tabpage: closing a tab page loses the alternate tab page (9.2.0923).\n * tests: Test_termwinscroll() fails on FreeBSD (9.2.0924).\n * crash when getcompletiontype() gets a NULL string (9.2.0925).\n * filetype: business Central files are not recognized (9.2.0926).\n * curswant not set on 8g8 (9.2.0927).\n * MinGW: tests hang when Vim is built with coverage enabled (9.2.0928).\n * incorrect completion for 'pumopt' and 'pumborder' (9.2.0929).\n * floating point exception when displaying pum (9.2.0930).\n * the GTK4 GUI is still experimental and untested by CI (9.2.0931).\n * NFA engine fallback can double free the compiled program (9.2.0932).\n * u_read_undo() leaks the file name when the undo file owner differs (9.2.0933).\n * filetype: hlsl files are not recognized (9.2.0934).\n * reading an undo file is slow with many undo headers (9.2.0935).\n * stringifying a list or dict can free the item being iterated (9.2.0936).\n * sort() with a numeric option converts each item on every comparison (9.2.0937).\n * cursorbind: cursor in the other window is not updated after undo (9.2.0938).\n * mbyte: wrong cell count for an overlong UTF-8 sequence (9.2.0939).\n * GTK4: columns are lost when a scrollbar appears (9.2.0940).\n * tests: clipboard tests fail in the GUI when the terminal has no clipboard (9.2.0941).\n * test: test_mksession_winpos() fails on GTK4 UI (9.2.0942).\n * test: test_hardcopy fails on GTK4 UI (9.2.0943).\n * test: tests fail when checking for GTK4 feature (9.2.0944).\n * sort() with a numeric option can be improved (9.2.0945).\n * GTK2/3: mouse move starts Visual selection after a dialog (9.2.0946).\n * GTK4: screen is cleared when moving the mouse after startup (9.2.0947).\n * GTK4: mouse move starts Visual selection after a dialog (9.2.0948).\n * GDK_KEY_VoidSymbol might be undefined (9.2.0949).\n * transstr() can be improved (after 9.2.0906) (9.2.0950).\n * GTK3: cursor does no longer blink (9.2.0951).\n * locking a container while stringifying can be improved (9.2.0952).\n * insert completion code can be improved (9.2.0953).\n * u_read_undo() can be improved (after 9.2.0935) (9.2.0954).\n * tests: terminal tests are flaky (9.2.0955).\n * GTK4: crash when the window is resized while redrawing (9.2.0956).\n * filetype: ArgoCD config file is not recognized (9.2.0957).\n","status":"published","published":"2026-08-21T14:22:06Z","modified":"2026-08-26T18:23:32.604401615Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8657-1","title":"vim vulnerabilities","description":"It was discovered that Vim incorrectly handled memory when decoding\ncertain JSON input. An attacker could possibly use this issue to cause\nVim to crash, resulting in a denial of service. This issue only affected\nUbuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-73071)\n\nYazan Balawneh discovered that Vim incorrectly handled memory when\nopening certain spell files. An attacker could possibly use this issue to\ncause Vim to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2026-73072)\n\nIt was discovered that Vim incorrectly handled memory when processing\ncertain files with a large number of text properties. An attacker could\npossibly use this issue to cause Vim to crash, resulting in a denial of\nservice, or possibly execute arbitrary code. This issue only affected\nUbuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-73074)\n\nIt was discovered that Vim incorrectly handled certain vimball files. An\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2026-73076)\n\nIt was discovered that Vim incorrectly handled shell arguments during\nkeyword lookups. An attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04\nLTS, and Ubuntu 26.04 LTS. (CVE-2026-73077)\n\nDavid Carliez discovered that Vim incorrectly handled certain directory\npaths when constructing netrw menus. An attacker could possibly use this\nissue to execute arbitrary code. (CVE-2026-73078)","status":"published","published":"2026-08-20T22:03:08Z","modified":"2026-10-08T12:48:07.010426012Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}