Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:2233-1

Опубликовано: 03 июн. 2026
Источник: suse-cvrf

Описание

Security update for vim

This update for vim fixes the following issues

  • CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim (bsc#1264706).
  • CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).
  • CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line completion (bsc#1264707).
  • CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).
  • CVE-2026-46483: command injection via tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems (bsc#1265360).

Changes for vim:

  • Update to v9.2.0530.
  • Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)

Список пакетов

Image SLES12-SP5-Azure-BYOS
vim-9.2.0530-17.68.1
vim-data-common-9.2.0530-17.68.1
Image SLES12-SP5-Azure-HPC-BYOS
vim-9.2.0530-17.68.1
vim-data-common-9.2.0530-17.68.1
Image SLES12-SP5-Azure-HPC-On-Demand
vim-9.2.0530-17.68.1
vim-data-common-9.2.0530-17.68.1
Image SLES12-SP5-Azure-SAP-BYOS
vim-9.2.0530-17.68.1
vim-data-common-9.2.0530-17.68.1
Image SLES12-SP5-Azure-SAP-On-Demand
vim-9.2.0530-17.68.1
vim-data-common-9.2.0530-17.68.1
Image SLES12-SP5-Azure-Standard-On-Demand
vim-9.2.0530-17.68.1
vim-data-common-9.2.0530-17.68.1
Image SLES12-SP5-EC2-BYOS
vim-9.2.0530-17.68.1
vim-data-common-9.2.0530-17.68.1
Image SLES12-SP5-EC2-ECS-On-Demand
vim-9.2.0530-17.68.1
vim-data-common-9.2.0530-17.68.1
Image SLES12-SP5-EC2-On-Demand
vim-9.2.0530-17.68.1
vim-data-common-9.2.0530-17.68.1
Image SLES12-SP5-EC2-SAP-BYOS
vim-9.2.0530-17.68.1
vim-data-common-9.2.0530-17.68.1
Image SLES12-SP5-EC2-SAP-On-Demand
vim-9.2.0530-17.68.1
vim-data-common-9.2.0530-17.68.1
Image SLES12-SP5-GCE-BYOS
vim-9.2.0530-17.68.1
vim-data-common-9.2.0530-17.68.1
Image SLES12-SP5-GCE-On-Demand
vim-9.2.0530-17.68.1
vim-data-common-9.2.0530-17.68.1
Image SLES12-SP5-GCE-SAP-BYOS
vim-9.2.0530-17.68.1
vim-data-common-9.2.0530-17.68.1
Image SLES12-SP5-GCE-SAP-On-Demand
vim-9.2.0530-17.68.1
vim-data-common-9.2.0530-17.68.1
SUSE Linux Enterprise Server 12 SP5-LTSS
gvim-9.2.0530-17.68.1
vim-9.2.0530-17.68.1
vim-data-9.2.0530-17.68.1
vim-data-common-9.2.0530-17.68.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
gvim-9.2.0530-17.68.1
vim-9.2.0530-17.68.1
vim-data-9.2.0530-17.68.1
vim-data-common-9.2.0530-17.68.1

Ссылки

Описание

Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:vim-9.2.0530-17.68.1
Image SLES12-SP5-Azure-BYOS:vim-data-common-9.2.0530-17.68.1
Image SLES12-SP5-Azure-HPC-BYOS:vim-9.2.0530-17.68.1
Image SLES12-SP5-Azure-HPC-BYOS:vim-data-common-9.2.0530-17.68.1
Ссылки

Описание

unknown

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:vim-9.2.0530-17.68.1
Image SLES12-SP5-Azure-BYOS:vim-data-common-9.2.0530-17.68.1
Image SLES12-SP5-Azure-HPC-BYOS:vim-9.2.0530-17.68.1
Image SLES12-SP5-Azure-HPC-BYOS:vim-data-common-9.2.0530-17.68.1
Ссылки

Описание

Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line completion. When the path option contains backtick-enclosed shell commands, those commands are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing an attacker who controls the contents of a file to execute arbitrary shell commands when the user opens that file in Vim and triggers :find completion. This issue has been patched in version 9.2.0435.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:vim-9.2.0530-17.68.1
Image SLES12-SP5-Azure-BYOS:vim-data-common-9.2.0530-17.68.1
Image SLES12-SP5-Azure-HPC-BYOS:vim-9.2.0530-17.68.1
Image SLES12-SP5-Azure-HPC-BYOS:vim-data-common-9.2.0530-17.68.1
Ссылки

Описание

Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has been patched in version 9.2.0450.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:vim-9.2.0530-17.68.1
Image SLES12-SP5-Azure-BYOS:vim-data-common-9.2.0530-17.68.1
Image SLES12-SP5-Azure-HPC-BYOS:vim-9.2.0530-17.68.1
Image SLES12-SP5-Azure-HPC-BYOS:vim-data-common-9.2.0530-17.68.1
Ссылки

Описание

Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:vim-9.2.0530-17.68.1
Image SLES12-SP5-Azure-BYOS:vim-data-common-9.2.0530-17.68.1
Image SLES12-SP5-Azure-HPC-BYOS:vim-9.2.0530-17.68.1
Image SLES12-SP5-Azure-HPC-BYOS:vim-data-common-9.2.0530-17.68.1
Ссылки
Уязвимость SUSE-SU-2026:2233-1