Описание
ELSA-2026-38510: vim security update (IMPORTANT)
[8.0.1763-27.0.1]
- Remove upstream references [Orabug: 31197557]
- Added glibc-gconv-extra to common requires to provide ISO-8859-2 [Orabug: 34114984]
[2:8.0.1763-27]
- RHEL-186656 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave
- RHEL-186648 CVE-2026-52858 vim: possible code execution with python3complete
[2:8.0.1763-26]
- CVE-2026-47167 vim: Code Injection in cucumber filetype plugin
[2:8.0.1763-25]
- RHEL-178234 CVE-2026-46483 vim: command injection in tar plugin via shellescape
Обновленные пакеты
Oracle Linux 8
Oracle Linux aarch64
vim-X11
8.0.1763-27.0.1.el8_10
vim-common
8.0.1763-27.0.1.el8_10
vim-enhanced
8.0.1763-27.0.1.el8_10
vim-filesystem
8.0.1763-27.0.1.el8_10
vim-minimal
8.0.1763-27.0.1.el8_10
Oracle Linux x86_64
vim-minimal
8.0.1763-27.0.1.el8_10
vim-X11
8.0.1763-27.0.1.el8_10
vim-common
8.0.1763-27.0.1.el8_10
vim-enhanced
8.0.1763-27.0.1.el8_10
vim-filesystem
8.0.1763-27.0.1.el8_10
Связанные уязвимости
Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479.
Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479.
Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479.