Описание
ELSA-2026-28209: vim security update (MODERATE)
[8.2.2637-26.0.1.el9_8.6]
- Remove upstream references [Orabug: 31197557]
[2:8.2.2637-26.6]
- CVE-2026-41411 vim: Command injection via backticks in tag files
[2:8.2.2637-26.5]
- RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass
[2:8.2.2637-26.4]
- Resolves: RHEL-164966 vim: arbitrary command execution via modeline sandbox bypass
[2:8.2.2637-26.3]
- Related: RHEL-159630 rebuild to build with exception target
[2:8.2.2637-26.2]
- remove -O0 from flags
[2:8.2.2637-26.1]
- RHEL-159630 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function
Обновленные пакеты
Oracle Linux 9
Oracle Linux aarch64
vim-X11
8.2.2637-26.0.1.el9_8.6
vim-common
8.2.2637-26.0.1.el9_8.6
vim-enhanced
8.2.2637-26.0.1.el9_8.6
vim-filesystem
8.2.2637-26.0.1.el9_8.6
vim-minimal
8.2.2637-26.0.1.el9_8.6
Oracle Linux x86_64
vim-X11
8.2.2637-26.0.1.el9_8.6
vim-common
8.2.2637-26.0.1.el9_8.6
vim-enhanced
8.2.2637-26.0.1.el9_8.6
vim-filesystem
8.2.2637-26.0.1.el9_8.6
vim-minimal
8.2.2637-26.0.1.el9_8.6
Связанные CVE
Связанные уязвимости
Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.
Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.
Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.
Vim: Command injection via backtick expansion in tag filenames
Vim is an open source, command line text editor. Prior to 9.2.0357, A ...