rpms/vim
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import UBI vim-8.2.2637-26.el9_8.10

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-07-13 11:11:38 -04:00
parent af3beefe87
commit 1faf7f879c
6 changed files with 522 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

91
SOURCES/0001-patch-9.2.0479-security-runtime-tar-command-injectio.patch Normal file
View File

@ -0,0 +1,91 @@
From a51ca3f97ec9362366c918d37905b3a083eff82e Mon Sep 17 00:00:00 2001
From: Christian Brabandt <cb@256bit.org>
Date: Thu, 14 May 2026 15:35:28 +0000
Subject: [PATCH] patch 9.2.0479: [security]: runtime(tar): command injection
in tar plugin
Problem: [security]: runtime(tar): command injection in tar plugin
(Christopher Lusk)
Solution: Use the correct shellescape(args, 1) form for a :! command
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w
Signed-off-by: Christian Brabandt <cb@256bit.org>
---
runtime/autoload/tar.vim | 4 ++--
src/testdir/Make_all.mak | 2 ++
src/testdir/test_plugin_tar.vim | 24 ++++++++++++++++++++++++
3 files changed, 28 insertions(+), 2 deletions(-)
create mode 100644 src/testdir/test_plugin_tar.vim
diff --git a/runtime/autoload/tar.vim b/runtime/autoload/tar.vim
index 13df5790a..ef7b21499 100644
--- a/runtime/autoload/tar.vim
+++ b/runtime/autoload/tar.vim
@@ -774,9 +774,9 @@ fun! tar#Vimuntar(...)
" if necessary, decompress the tarball; then, extract it
if tartail =~ '\.tgz'
if executable("gunzip")
- silent exe "!gunzip ".shellescape(tartail)
+ silent exe "!gunzip ".shellescape(tartail, 1)
elseif executable("gzip")
- silent exe "!gzip -d ".shellescape(tartail)
+ silent exe "!gzip -d ".shellescape(tartail, 1)
else
echoerr "unable to decompress<".tartail."> on this sytem"
if simplify(curdir) != simplify(tarhome)
diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
index 111111111..222222222 100644
--- a/src/testdir/Make_all.mak
+++ b/src/testdir/Make_all.mak
@@ -209,6 +209,7 @@ NEW_TESTS = \
test_paste \
test_perl \
+ test_plugin_tar \
test_plus_arg_edit \
test_popup \
test_popupwin \
test_popupwin_textprop \
@@ -447,6 +448,7 @@ NEW_TESTS_RES = \
test_paste.res \
test_perl.res \
+ test_plugin_tar.res \
test_plus_arg_edit.res \
test_popup.res \
test_popupwin.res \
test_popupwin_textprop.res \
diff --git a/src/testdir/test_plugin_tar.vim b/src/testdir/test_plugin_tar.vim
new file mode 100644
index 000000000..000000001
--- /dev/null
+++ b/src/testdir/test_plugin_tar.vim
@@ -0,0 +1,25 @@
+vim9script
+
+source check.vim
+CheckNotMSWindows
+
+runtime plugin/tarPlugin.vim
+
+def g:Test_extract_command_injection()
+ CheckExecutable gunzip
+ CheckExecutable touch
+ var tgz = eval('0z1F8B08087795056A000364756D6D792E74617200EDCE2B12C2300004D01C254' ..
+ '7480269CE534080A8495BD1DBF3996106C3A08A7ACFACD8157B59A7690BFB4A0FC3707C666E357D' ..
+ 'E65BC8B5A47CC8A5D61A522EA5B510D3CEBF5ED679197B8CE17CEDB7F9D4C76FBB5F3D000000000' ..
+ '000000000FCD11D32415E2C00280000')
+ var dirname = tempname()
+
+ mkdir(dirname, 'R')
+ var tar = dirname .. "/';%$(touch pwned)'.tgz"
+ writefile(tgz, tar)
+ new
+ exe "e " .. fnameescape(tar)
+ exe ":Vimuntar " .. dirname
+ assert_false(filereadable(dirname .. "/pwned"))
+ bw!
+enddef
--
2.52.0

81
SOURCES/0001-patch-9.2.0495-security-runtime-netrw-code-injection.patch Normal file
View File

@ -0,0 +1,81 @@
From 2a865546a8d61f55f7999e48575e59a526286cee Mon Sep 17 00:00:00 2001
From: Christian Brabandt <cb@256bit.org>
Date: Sun, 17 May 2026 18:53:48 +0000
Subject: [PATCH] patch 9.2.0495: [security]: runtime(netrw): code injection
via NetrwBookHistSave()
Problem: [security]: runtime(netrw): code injection via
NetrwBookHistSave()
Solution: Properly quote the directory name using string() function
(Srinivas Piskala Ganesh Babu)
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c
Signed-off-by: Christian Brabandt <cb@256bit.org>
---
runtime/autoload/netrw.vim | 2 +-
src/testdir/Make_all.mak | 2 ++
src/testdir/test_plugin_netrw.vim | 22 ++++++++++++++++++++++
3 files changed, 25 insertions(+), 1 deletion(-)
create mode 100644 src/testdir/test_plugin_netrw.vim
diff --git a/runtime/autoload/netrw.vim b/runtime/autoload/netrw.vim
index 5fd08acfd..41893e2fd 100644
--- a/runtime/autoload/netrw.vim
+++ b/runtime/autoload/netrw.vim
@@ -3736,7 +3736,7 @@ fun! s:NetrwBookHistSave()
while ( first || cnt != g:netrw_dirhistcnt )
let lastline= lastline + 1
if exists("g:netrw_dirhist_{cnt}")
- call setline(lastline,'let g:netrw_dirhist_'.cnt."='".g:netrw_dirhist_{cnt}."'")
+ call setline(lastline,'let g:netrw_dirhist_'.cnt.'='.string(g:netrw_dirhist_{cnt}))
" call Decho("..".lastline.'let g:netrw_dirhist_'.cnt."='".g:netrw_dirhist_{cnt}."'",'~'.expand("<slnum>"))
endif
let first = 0
diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
index 7fd4e89a2..1709886b4 100644
--- a/src/testdir/Make_all.mak
+++ b/src/testdir/Make_all.mak
@@ -209,6 +209,7 @@ NEW_TESTS = \
test_partial \
test_paste \
test_perl \
+ test_plugin_netrw \
test_plugin_tar \
test_plus_arg_edit \
test_popup \
@@ -448,6 +449,7 @@ NEW_TESTS_RES = \
test_partial.res \
test_paste.res \
test_perl.res \
+ test_plugin_netrw.res \
test_plugin_tar.res \
test_plus_arg_edit.res \
test_popup.res \
diff --git a/src/testdir/test_plugin_netrw.vim b/src/testdir/test_plugin_netrw.vim
new file mode 100644
index 000000000..78ad4bf5c
--- /dev/null
+++ b/src/testdir/test_plugin_netrw.vim
@@ -0,0 +1,20 @@
+func Test_netrw_injection()
+ let g:netrw_home = getcwd()
+ let savefile = g:netrw_home . '/.netrwhist'
+ let g:netrw_dirhistmax = 10
+ let g:netrw_dirhistcnt = 1
+ let g:netrw_dirhist_1 = "x'|let g:injected = 1|let y='z"
+ call delete(savefile)
+ try
+ call netrw#Call('NetrwBookHistSave')
+ call assert_true(filereadable(savefile), savefile . ' must be written')
+ unlet g:netrw_dirhist_1
+ execute 'source ' . fnameescape(savefile)
+ call assert_false(exists("g:injected"), 'injected statement must not execute')
+ call assert_equal("x'|let g:injected = 1|let y='z", g:netrw_dirhist_1, 'dirname must round-trip')
+ finally
+ call delete(savefile)
+ unlet! g:netrw_home g:netrw_dirhistmax g:netrw_dirhistcnt g:netrw_dirhist_1 g:injected
+ endtry
+endfunc
+" vim:ts=8 sts=2 sw=2 et

73
SOURCES/0001-patch-9.2.0496-security-Code-Injection-in-cucumber-f.patch Normal file
View File

@ -0,0 +1,73 @@
diff -up vim82/runtime/ftplugin/cucumber.vim.cucumber-code-inject vim82/runtime/ftplugin/cucumber.vim
--- vim82/runtime/ftplugin/cucumber.vim.cucumber-code-inject 2021-03-22 10:02:41.000000000 +0100
+++ vim82/runtime/ftplugin/cucumber.vim 2026-06-30 15:35:41.267808950 +0200
@@ -96,7 +96,8 @@ function! s:stepmatch(receiver,target)
catch
endtry
if has("ruby") && pattern !~ '\\\@<!#{'
- ruby VIM.command("return #{if (begin; Kernel.eval('/'+VIM.evaluate('pattern')+'/'); rescue SyntaxError; end) === VIM.evaluate('a:target') then 1 else 0 end}")
+ " Use Regexp.new, so the pattern stays untrusted data and cannot inject Ruby
+ ruby VIM.command("return #{if (begin; Regexp.new(VIM.evaluate('pattern')); rescue RegexpError; end) === VIM.evaluate('a:target') then 1 else 0 end}")
else
return 0
endif
diff -up vim82/src/testdir/test_filetype.vim.cucumber-code-inject vim82/src/testdir/test_filetype.vim
--- vim82/src/testdir/test_filetype.vim.cucumber-code-inject 2026-06-30 15:35:41.138110899 +0200
+++ vim82/src/testdir/test_filetype.vim 2026-06-30 15:36:47.232303826 +0200
@@ -786,4 +786,35 @@ func Test_pp_file()
endfunc
+func Test_cucumber_code_injection()
+ source check.vim
+ CheckFeature ruby
+ filetype plugin on
+
+ call mkdir('Xcucu/features/step_definitions', 'pR')
+ call writefile([
+ \ 'Feature: demo',
+ \ ' Scenario: trigger',
+ \ ' Given xyzzy',
+ \ ], 'Xcucu/features/test.feature')
+ let marker = getcwd() . '/Xcucu/MARKER'
+ " Malicious step: terminates the regex literal, injects Ruby system(),
+ " comments the trailing slash. With the fix, the pattern is passed to
+ " Regexp.new() instead of Kernel.eval() and the payload is inert.
+ call writefile([
+ \ 'Given /xyzzy/; system("touch ' . marker . '"); #/ do',
+ \ 'end',
+ \ ], 'Xcucu/features/step_definitions/poc.rb')
+
+ new Xcucu/features/test.feature
+ call assert_equal('cucumber', &filetype)
+ call cursor(3, 1)
+ " Triggers s:jump -> s:steps -> s:stepmatch on every discovered step,
+ " including the malicious one. Suppress preview and error messages.
+ silent! normal [d
+ call assert_false(filereadable(marker), 'Ruby injection executed')
+ bwipe!
+ filetype plugin off
+endfunc
+
" vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/testdir/test_filetype.vim b/src/testdir/test_filetype.vim
index 21e2c1d..5308fbb 100644
--- a/src/testdir/test_filetype.vim
+++ b/src/testdir/test_filetype.vim
@@ -791,7 +791,7 @@ func Test_cucumber_code_injection()
CheckFeature ruby
filetype plugin on
- call mkdir('Xcucu/features/step_definitions', 'pR')
+ call mkdir('Xcucu/features/step_definitions', 'p')
call writefile([
\ 'Feature: demo',
\ ' Scenario: trigger',
@@ -814,6 +814,7 @@ func Test_cucumber_code_injection()
silent! normal [d
call assert_false(filereadable(marker), 'Ruby injection executed')
bwipe!
+ call delete('Xcucu', 'rf')
filetype plugin off
endfunc

138
SOURCES/0001-patch-9.2.0561-security-possible-code-execution-with.patch Normal file
View File

@ -0,0 +1,138 @@
From db925fe32f76caa3abe5c581ae71540a11f49d36 Mon Sep 17 00:00:00 2001
From: Christian Brabandt <cb@256bit.org>
Date: Fri, 29 May 2026 19:05:53 +0000
Subject: [PATCH] patch 9.2.0561: [security]: possible code execution with
python3complete
Problem: [security]: possible code execution with python3complete
Solution: Disable execution of import/from statements
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c
Signed-off-by: Christian Brabandt <cb@256bit.org>
---
runtime/autoload/README.txt | 1 +
runtime/autoload/python3complete.vim | 13 ++++++++++---
runtime/autoload/pythoncomplete.vim | 13 ++++++++++---
runtime/doc/filetype.txt | 15 ++++++++++++++-
4 files changed, 35 insertions(+), 7 deletions(-)
diff --git a/runtime/autoload/README.txt b/runtime/autoload/README.txt
index 3b18d3dde..b22581963 100644
--- a/runtime/autoload/README.txt
+++ b/runtime/autoload/README.txt
@@ -17,6 +17,7 @@ htmlcomplete.vim HTML
javascriptcomplete.vim Javascript
phpcomplete.vim PHP
pythoncomplete.vim Python
+python3complete.vim Python
rubycomplete.vim Ruby
syntaxcomplete.vim from syntax highlighting
xmlcomplete.vim XML (uses files in the xml directory)
diff --git a/runtime/autoload/python3complete.vim b/runtime/autoload/python3complete.vim
index 6894bd63e..c8d692cdd 100644
--- a/runtime/autoload/python3complete.vim
+++ b/runtime/autoload/python3complete.vim
@@ -129,11 +129,20 @@ class Completer(object):
def evalsource(self,text,line=0):
sc = self.parser.parse(text,line)
+ try: allow_imports = int(
+ vim.eval("get(g:, 'pythoncomplete_allow_import', 0)"))
+ except Exception:
+ allow_imports = 0
src = sc.get_code()
dbg("source: %s" % src)
try: exec(src,self.compldict)
except: dbg("parser: %s, %s" % (sys.exc_info()[0],sys.exc_info()[1]))
for l in sc.locals:
+ # Executing import/from statements harvested from the buffer runs
+ # arbitrary package code; only do so when the user opted in.
+ if not allow_imports and (l.startswith('import')
+ or l.startswith('from ')):
+ continue
try: exec(l,self.compldict)
except: dbg("locals: %s, %s [%s]" % (sys.exc_info()[0],sys.exc_info()[1],l))
@@ -297,13 +306,11 @@ class Scope(object):
def get_code(self):
str = ""
if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
- for l in self.locals:
- if l.startswith('import'): str += l+'\n'
str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n'
for sub in self.subscopes:
str += sub.get_code()
for l in self.locals:
- if not l.startswith('import'): str += l+'\n'
+ if not l.startswith('import') and not l.startswith('from '): str += l+'\n'
return str
diff --git a/runtime/autoload/pythoncomplete.vim b/runtime/autoload/pythoncomplete.vim
index 5f6fee58c..f2c376f81 100644
--- a/runtime/autoload/pythoncomplete.vim
+++ b/runtime/autoload/pythoncomplete.vim
@@ -146,11 +146,20 @@ class Completer(object):
def evalsource(self,text,line=0):
sc = self.parser.parse(text,line)
+ try: allow_imports = int(
+ vim.eval("get(g:, 'pythoncomplete_allow_import', 0)"))
+ except Exception:
+ allow_imports = 0
src = sc.get_code()
dbg("source: %s" % src)
try: exec(src) in self.compldict
except: dbg("parser: %s, %s" % (sys.exc_info()[0],sys.exc_info()[1]))
for l in sc.locals:
+ # Executing import/from statements harvested from the buffer runs
+ # arbitrary package code; only do so when the user opted in.
+ if not allow_imports and (l.startswith('import')
+ or l.startswith('from ')):
+ continue
try: exec(l) in self.compldict
except: dbg("locals: %s, %s [%s]" % (sys.exc_info()[0],sys.exc_info()[1],l))
@@ -315,13 +324,11 @@ class Scope(object):
def get_code(self):
str = ""
if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n'
- for l in self.locals:
- if l.startswith('import'): str += l+'\n'
str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n'
for sub in self.subscopes:
str += sub.get_code()
for l in self.locals:
- if not l.startswith('import'): str += l+'\n'
+ if not l.startswith('import') and not l.startswith('from '): str += l+'\n'
return str
diff --git a/runtime/doc/filetype.txt b/runtime/doc/filetype.txt
index 318507c16..83325a40b 100644
--- a/runtime/doc/filetype.txt
+++ b/runtime/doc/filetype.txt
@@ -658,7 +658,20 @@ By default the following options are set, in accordance with PEP8: >
To disable this behavior, set the following variable in your vimrc: >
let g:python_recommended_style = 0
-
+<
+Python omni-completion |compl-omni| is provided by python3complete.vim (or
+pythoncomplete.vim) for Vim builds with the |+python|/|+python3| interpreter.
+By default it does not inspect the import / from statements found in the
+buffer. This means completion of names defined in the buffer itself (classes,
+functions, variables) works, but completion of members of imported modules is
+not offered.
+
+To enable completion of imported module members, set: >
+ let g:pythoncomplete_allow_import = 1
+<
+WARNING: enabling this causes omni-completion to execute the import statements
+found in the buffer through Python's import machinery, which runs the imported
+modules' top-level code. Only enable this for code you trust.
QF QUICKFIX *qf.vim* *ft-qf-plugin*

84
SOURCES/0001-patch-9.2.0568-pythoncomplete-g-pythoncomplete_allow.patch Normal file
View File

@ -0,0 +1,84 @@
From ce0f5cf9a473b0ca8cd2b488d5dc159588a6c026 Mon Sep 17 00:00:00 2001
From: thinca <thinca@gmail.com>
Date: Sun, 31 May 2026 12:33:07 +0000
Subject: [PATCH] patch 9.2.0568: pythoncomplete: g:pythoncomplete_allow_import
had no effect
Problem: The security patch 9.2.0561 added a vim.eval() call inside
Completer.evalsource() to honor g:pythoncomplete_allow_import.
But the 'vim' module is only imported inside the outer
vimcomplete() / vimpy3complete() function, not at the script's
top level, so referring to it from a Completer method raises
NameError. The surrounding bare 'except' silently swallows
the error and leaves allow_imports at 0, meaning the opt-in
never takes effect -- 'import os' (and any other
buffer-level import) is always skipped, no candidates are
produced for 'os.<...>' and
Test_popup_and_preview_autocommand() fails on the Windows
CI matrix (Linux skips the test because Python 2 is absent).
Solution: Re-import 'vim' at the top of evalsource() in both
pythoncomplete.vim and python3complete.vim so the eval reads
the global, and set g:pythoncomplete_allow_import = 1 in the
test (it is the opt-in intended for callers that trust the
buffer contents) (thinca).
closes: #20386
Signed-off-by: thinca <thinca@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---
runtime/autoload/python3complete.vim | 3 +++
runtime/autoload/pythoncomplete.vim | 3 +++
src/testdir/test_popup.vim | 4 ++++
3 files changed, 10 insertions(+)
diff --git a/runtime/autoload/python3complete.vim b/runtime/autoload/python3complete.vim
index c8d692cdd..279094f44 100644
--- a/runtime/autoload/python3complete.vim
+++ b/runtime/autoload/python3complete.vim
@@ -128,6 +128,9 @@ class Completer(object):
self.parser = PyParser()
def evalsource(self,text,line=0):
+ # vim is imported locally in vimpy3complete(); re-import here so the
+ # vim.eval() below works (otherwise NameError, silently caught).
+ import vim
sc = self.parser.parse(text,line)
try: allow_imports = int(
vim.eval("get(g:, 'pythoncomplete_allow_import', 0)"))
diff --git a/runtime/autoload/pythoncomplete.vim b/runtime/autoload/pythoncomplete.vim
index f2c376f81..8986edffc 100644
--- a/runtime/autoload/pythoncomplete.vim
+++ b/runtime/autoload/pythoncomplete.vim
@@ -145,6 +145,9 @@ class Completer(object):
self.parser = PyParser()
def evalsource(self,text,line=0):
+ # vim is imported locally in vimcomplete(); re-import here so the
+ # vim.eval() below works (otherwise NameError, silently caught).
+ import vim
sc = self.parser.parse(text,line)
try: allow_imports = int(
vim.eval("get(g:, 'pythoncomplete_allow_import', 0)"))
diff --git a/src/testdir/test_popup.vim b/src/testdir/test_popup.vim
index c8f8820af..894e2ff1e 100644
--- a/src/testdir/test_popup.vim
+++ b/src/testdir/test_popup.vim
@@ -708,6 +708,9 @@ func Test_popup_and_preview_autocommand()
au!
au BufAdd * nested tab sball
augroup END
+ " Let pythoncomplete follow the buffer's 'import os' (off by default
+ " since v9.2.0561) so 'os.' can be completed.
+ let g:pythoncomplete_allow_import = 1
set omnifunc=pythoncomplete#Complete
call setline(1, 'import os')
" make the line long
@@ -730,6 +733,7 @@ func Test_popup_and_preview_autocommand()
augroup END
augroup! MyBufAdd
bw!
+ unlet g:pythoncomplete_allow_import
endfunc
func Test_popup_and_previewwindow_dump()

56
SPECS/vim.spec
View File

@ -27,7 +27,7 @@ Summary: The VIM editor
URL: http://www.vim.org/
Name: vim
Version: %{baseversion}.%{patchlevel}
Release: 26%{?dist}.6
Release: 26%{?dist}.10
License: Vim and MIT
Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2
Source1: virc
@ -196,6 +196,41 @@ Patch3070: 0001-patch-9.2.0304-zip-block-absolute-paths-in-Extract.patch
# https://redhat.atlassian.net/browse/RHEL-171495
# https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb
Patch3071: 0001-patch-9.2.0357-security-command-injection-via-backti.patch
# RHEL-178243 CVE-2026-46483 runtime(tar): command injection in tar plugin
# https://redhat.atlassian.net/browse/RHEL-178243
# https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1
# Omitted src/version.c changes per downstream policy
# Omitted 'Last Change' comments in tar.vim per downstream policy
# Reduced test file to only Test_extract_command_injection
# Added Make_all.mak changes from upstream commit 87757c6b0a4
# Added sourcing of check.vim in test file - defines Check* functions,
# needed to explicitly specify in older Vim
Patch3072: 0001-patch-9.2.0479-security-runtime-tar-command-injectio.patch
# RHEL-185874 CVE-2026-47167 vim: Code Injection in cucumber filetype plugin
# https://redhat.atlassian.net/browse/RHEL-185874
# https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934
# Omitted src/version.c changes per downstream policy
# Omitted 'Last Change' comments in cucumber.vim per downstream policy
Patch3073: 0001-patch-9.2.0496-security-Code-Injection-in-cucumber-f.patch
# RHEL-186646 CVE-2026-52858 [security]: possible code execution with python3complete
# https://redhat.atlassian.net/browse/RHEL-186646
# https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d
# Omitted src/version.c changes per downstream policy
# Omitted 'Last Changes' comments in python3complete.vim and pythoncomplete.vim per downstream policy
Patch3074: 0001-patch-9.2.0561-security-possible-code-execution-with.patch
# RHEL-186646 CVE-2026-52858 pythoncomplete: g:pythoncomplete_allow_import had no effect
# https://redhat.atlassian.net/browse/RHEL-186646
# https://github.com/vim/vim/commit/868ad62cb8bf8038322eab2badd31bd98b02b9df
# Omitted src/version.c changes per downstream policy
Patch3075: 0001-patch-9.2.0568-pythoncomplete-g-pythoncomplete_allow.patch
# RHEL-186659 CVE-2026-47162 vim: code injection via NetrwBookHistSave()
# https://redhat.atlassian.net/browse/RHEL-186659
# https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b
# Omitted src/version.c changes per downstream policy
# Applied fix to runtime/autoload/netrw.vim (RHEL path) instead of runtime/pack/dist/opt/netrw/autoload/netrw.vim
# Created new test file test_plugin_netrw.vim with minimal test
# Added test_plugin_netrw to Make_all.mak
Patch3076: 0001-patch-9.2.0495-security-runtime-netrw-code-injection.patch
# gcc is no longer in buildroot by default
@ -455,6 +490,11 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
%patch -P 3069 -p1 -b .zip-abs-write
%patch -P 3070 -p1 -b .zip-abs-extract
%patch -P 3071 -p1 -b .tag-backtick-inject
%patch -P 3072 -p1 -b .tar-cmd-inject
%patch -P 3073 -p1 -b .cucumber-code-inject
%patch -P 3074 -p1 -b .python3complete-code-exec
%patch -P 3075 -p1 -b .pythoncomplete-allow-import
%patch -P 3076 -p1 -b .netrw-code-inject
%build
cd src
@ -1007,6 +1047,20 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
%endif
%changelog
* Wed Jul 01 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.2.2637-26.10
- RHEL-186659 CVE-2026-47162 vim: code injection via
NetrwBookHistSave()
* Wed Jul 01 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.2.2637-26.9
- RHEL-186646 CVE-2026-52858 vim: possible code execution with
python3complete
* Mon Jun 22 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.2.2637-26.8
- RHEL-185874 CVE-2026-47167 vim: Code Injection in cucumber filetype plugin
* Thu May 28 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.2.2637-26.7
- RHEL-178243 CVE-2026-46483 vim: command injection in tar plugin
* Thu May 21 2026 Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-26.6
- CVE-2026-41411 vim: Command injection via backticks in tag files