ELSA-2026-22730

Опубликовано: 04 июн. 2026

Источник: oracle-oval

Платформа: Oracle Linux 8

Описание

ELSA-2026-22730: vim security update (MODERATE)

[8.0.1763-23.0.1]

Remove upstream references [Orabug: 31197557]
Added glibc-gconv-extra to common requires to provide ISO-8859-2 [Orabug: 34114984]

[2:8.0.1763-23]

RHEL-170126 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass

[2:8.0.1763-22.3]

Relates: RHEL-164956 vim: arbitrary command execution via modeline sandbox bypass

[2:8.0.1763-22.2]

Resolves: RHEL-164956 vim: arbitrary command execution via modeline sandbox bypass

[2:8.0.1763-22.1]

RHEL-159620 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function
RHEL-155428 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin
RHEL-155412 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file

Обновленные пакеты

Oracle Linux 8

Oracle Linux aarch64

vim-X11

8.0.1763-23.0.1.el8_10

vim-common

8.0.1763-23.0.1.el8_10

vim-enhanced

8.0.1763-23.0.1.el8_10

vim-filesystem

8.0.1763-23.0.1.el8_10

vim-minimal

8.0.1763-23.0.1.el8_10

Oracle Linux x86_64

vim-X11

8.0.1763-23.0.1.el8_10

vim-common

8.0.1763-23.0.1.el8_10

vim-enhanced

8.0.1763-23.0.1.el8_10

vim-filesystem

8.0.1763-23.0.1.el8_10

vim-minimal

8.0.1763-23.0.1.el8_10

Связанные CVE

CVE-2026-35177

Ссылки на источники

Связанные уязвимости

CVE-2026-35177

CVSS3: 4.1

ubuntu

4 месяца назад

Vim is an open source, command line text editor. Prior to 9.2.0280, a path traversal bypass in Vim's zip.vim plugin allows overwriting of arbitrary files when opening specially crafted zip archives, circumventing the previous fix for CVE-2025-53906. This vulnerability is fixed in 9.2.0280.