diff --git a/SOURCES/0001-patch-9.2.0479-security-runtime-tar-command-injectio.patch b/SOURCES/0001-patch-9.2.0479-security-runtime-tar-command-injectio.patch new file mode 100644 index 00000000..3599a5cc --- /dev/null +++ b/SOURCES/0001-patch-9.2.0479-security-runtime-tar-command-injectio.patch @@ -0,0 +1,91 @@ +From a51ca3f97ec9362366c918d37905b3a083eff82e Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Thu, 14 May 2026 15:35:28 +0000 +Subject: [PATCH] patch 9.2.0479: [security]: runtime(tar): command injection + in tar plugin + +Problem: [security]: runtime(tar): command injection in tar plugin + (Christopher Lusk) +Solution: Use the correct shellescape(args, 1) form for a :! command + +Github Advisory: +https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w + +Signed-off-by: Christian Brabandt +--- + runtime/autoload/tar.vim | 4 ++-- + src/testdir/Make_all.mak | 2 ++ + src/testdir/test_plugin_tar.vim | 24 ++++++++++++++++++++++++ + 3 files changed, 28 insertions(+), 2 deletions(-) + create mode 100644 src/testdir/test_plugin_tar.vim + +diff --git a/runtime/autoload/tar.vim b/runtime/autoload/tar.vim +index 13df5790a..ef7b21499 100644 +--- a/runtime/autoload/tar.vim ++++ b/runtime/autoload/tar.vim +@@ -774,9 +774,9 @@ fun! tar#Vimuntar(...) + " if necessary, decompress the tarball; then, extract it + if tartail =~ '\.tgz' + if executable("gunzip") +- silent exe "!gunzip ".shellescape(tartail) ++ silent exe "!gunzip ".shellescape(tartail, 1) + elseif executable("gzip") +- silent exe "!gzip -d ".shellescape(tartail) ++ silent exe "!gzip -d ".shellescape(tartail, 1) + else + echoerr "unable to decompress<".tartail."> on this sytem" + if simplify(curdir) != simplify(tarhome) +diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak +index 111111111..222222222 100644 +--- a/src/testdir/Make_all.mak ++++ b/src/testdir/Make_all.mak +@@ -209,6 +209,7 @@ NEW_TESTS = \ + test_paste \ + test_perl \ ++ test_plugin_tar \ + test_plus_arg_edit \ + test_popup \ + test_popupwin \ + test_popupwin_textprop \ +@@ -447,6 +448,7 @@ NEW_TESTS_RES = \ + test_paste.res \ + test_perl.res \ ++ test_plugin_tar.res \ + test_plus_arg_edit.res \ + test_popup.res \ + test_popupwin.res \ + test_popupwin_textprop.res \ +diff --git a/src/testdir/test_plugin_tar.vim b/src/testdir/test_plugin_tar.vim +new file mode 100644 +index 000000000..000000001 +--- /dev/null ++++ b/src/testdir/test_plugin_tar.vim +@@ -0,0 +1,25 @@ ++vim9script ++ ++source check.vim ++CheckNotMSWindows ++ ++runtime plugin/tarPlugin.vim ++ ++def g:Test_extract_command_injection() ++ CheckExecutable gunzip ++ CheckExecutable touch ++ var tgz = eval('0z1F8B08087795056A000364756D6D792E74617200EDCE2B12C2300004D01C254' .. ++ '7480269CE534080A8495BD1DBF3996106C3A08A7ACFACD8157B59A7690BFB4A0FC3707C666E357D' .. ++ 'E65BC8B5A47CC8A5D61A522EA5B510D3CEBF5ED679197B8CE17CEDB7F9D4C76FBB5F3D000000000' .. ++ '000000000FCD11D32415E2C00280000') ++ var dirname = tempname() ++ ++ mkdir(dirname, 'R') ++ var tar = dirname .. "/';%$(touch pwned)'.tgz" ++ writefile(tgz, tar) ++ new ++ exe "e " .. fnameescape(tar) ++ exe ":Vimuntar " .. dirname ++ assert_false(filereadable(dirname .. "/pwned")) ++ bw! ++enddef +-- +2.52.0 + diff --git a/SOURCES/0001-patch-9.2.0495-security-runtime-netrw-code-injection.patch b/SOURCES/0001-patch-9.2.0495-security-runtime-netrw-code-injection.patch new file mode 100644 index 00000000..529eb280 --- /dev/null +++ b/SOURCES/0001-patch-9.2.0495-security-runtime-netrw-code-injection.patch @@ -0,0 +1,81 @@ +From 2a865546a8d61f55f7999e48575e59a526286cee Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Sun, 17 May 2026 18:53:48 +0000 +Subject: [PATCH] patch 9.2.0495: [security]: runtime(netrw): code injection + via NetrwBookHistSave() + +Problem: [security]: runtime(netrw): code injection via + NetrwBookHistSave() +Solution: Properly quote the directory name using string() function + (Srinivas Piskala Ganesh Babu) + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c + +Signed-off-by: Christian Brabandt +--- + runtime/autoload/netrw.vim | 2 +- + src/testdir/Make_all.mak | 2 ++ + src/testdir/test_plugin_netrw.vim | 22 ++++++++++++++++++++++ + 3 files changed, 25 insertions(+), 1 deletion(-) + create mode 100644 src/testdir/test_plugin_netrw.vim + +diff --git a/runtime/autoload/netrw.vim b/runtime/autoload/netrw.vim +index 5fd08acfd..41893e2fd 100644 +--- a/runtime/autoload/netrw.vim ++++ b/runtime/autoload/netrw.vim +@@ -3736,7 +3736,7 @@ fun! s:NetrwBookHistSave() + while ( first || cnt != g:netrw_dirhistcnt ) + let lastline= lastline + 1 + if exists("g:netrw_dirhist_{cnt}") +- call setline(lastline,'let g:netrw_dirhist_'.cnt."='".g:netrw_dirhist_{cnt}."'") ++ call setline(lastline,'let g:netrw_dirhist_'.cnt.'='.string(g:netrw_dirhist_{cnt})) + " call Decho("..".lastline.'let g:netrw_dirhist_'.cnt."='".g:netrw_dirhist_{cnt}."'",'~'.expand("")) + endif + let first = 0 +diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak +index 7fd4e89a2..1709886b4 100644 +--- a/src/testdir/Make_all.mak ++++ b/src/testdir/Make_all.mak +@@ -209,6 +209,7 @@ NEW_TESTS = \ + test_partial \ + test_paste \ + test_perl \ ++ test_plugin_netrw \ + test_plugin_tar \ + test_plus_arg_edit \ + test_popup \ +@@ -448,6 +449,7 @@ NEW_TESTS_RES = \ + test_partial.res \ + test_paste.res \ + test_perl.res \ ++ test_plugin_netrw.res \ + test_plugin_tar.res \ + test_plus_arg_edit.res \ + test_popup.res \ +diff --git a/src/testdir/test_plugin_netrw.vim b/src/testdir/test_plugin_netrw.vim +new file mode 100644 +index 000000000..78ad4bf5c +--- /dev/null ++++ b/src/testdir/test_plugin_netrw.vim +@@ -0,0 +1,20 @@ ++func Test_netrw_injection() ++ let g:netrw_home = getcwd() ++ let savefile = g:netrw_home . '/.netrwhist' ++ let g:netrw_dirhistmax = 10 ++ let g:netrw_dirhistcnt = 1 ++ let g:netrw_dirhist_1 = "x'|let g:injected = 1|let y='z" ++ call delete(savefile) ++ try ++ call netrw#Call('NetrwBookHistSave') ++ call assert_true(filereadable(savefile), savefile . ' must be written') ++ unlet g:netrw_dirhist_1 ++ execute 'source ' . fnameescape(savefile) ++ call assert_false(exists("g:injected"), 'injected statement must not execute') ++ call assert_equal("x'|let g:injected = 1|let y='z", g:netrw_dirhist_1, 'dirname must round-trip') ++ finally ++ call delete(savefile) ++ unlet! g:netrw_home g:netrw_dirhistmax g:netrw_dirhistcnt g:netrw_dirhist_1 g:injected ++ endtry ++endfunc ++" vim:ts=8 sts=2 sw=2 et diff --git a/SOURCES/0001-patch-9.2.0496-security-Code-Injection-in-cucumber-f.patch b/SOURCES/0001-patch-9.2.0496-security-Code-Injection-in-cucumber-f.patch new file mode 100644 index 00000000..b4e84f35 --- /dev/null +++ b/SOURCES/0001-patch-9.2.0496-security-Code-Injection-in-cucumber-f.patch @@ -0,0 +1,73 @@ +diff -up vim82/runtime/ftplugin/cucumber.vim.cucumber-code-inject vim82/runtime/ftplugin/cucumber.vim +--- vim82/runtime/ftplugin/cucumber.vim.cucumber-code-inject 2021-03-22 10:02:41.000000000 +0100 ++++ vim82/runtime/ftplugin/cucumber.vim 2026-06-30 15:35:41.267808950 +0200 +@@ -96,7 +96,8 @@ function! s:stepmatch(receiver,target) + catch + endtry + if has("ruby") && pattern !~ '\\\@ s:steps -> s:stepmatch on every discovered step, ++ " including the malicious one. Suppress preview and error messages. ++ silent! normal [d ++ call assert_false(filereadable(marker), 'Ruby injection executed') ++ bwipe! ++ filetype plugin off ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +diff --git a/src/testdir/test_filetype.vim b/src/testdir/test_filetype.vim +index 21e2c1d..5308fbb 100644 +--- a/src/testdir/test_filetype.vim ++++ b/src/testdir/test_filetype.vim +@@ -791,7 +791,7 @@ func Test_cucumber_code_injection() + CheckFeature ruby + filetype plugin on + +- call mkdir('Xcucu/features/step_definitions', 'pR') ++ call mkdir('Xcucu/features/step_definitions', 'p') + call writefile([ + \ 'Feature: demo', + \ ' Scenario: trigger', +@@ -814,6 +814,7 @@ func Test_cucumber_code_injection() + silent! normal [d + call assert_false(filereadable(marker), 'Ruby injection executed') + bwipe! ++ call delete('Xcucu', 'rf') + filetype plugin off + endfunc + diff --git a/SOURCES/0001-patch-9.2.0561-security-possible-code-execution-with.patch b/SOURCES/0001-patch-9.2.0561-security-possible-code-execution-with.patch new file mode 100644 index 00000000..6007c106 --- /dev/null +++ b/SOURCES/0001-patch-9.2.0561-security-possible-code-execution-with.patch @@ -0,0 +1,138 @@ +From db925fe32f76caa3abe5c581ae71540a11f49d36 Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Fri, 29 May 2026 19:05:53 +0000 +Subject: [PATCH] patch 9.2.0561: [security]: possible code execution with + python3complete + +Problem: [security]: possible code execution with python3complete +Solution: Disable execution of import/from statements + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c + +Signed-off-by: Christian Brabandt +--- + runtime/autoload/README.txt | 1 + + runtime/autoload/python3complete.vim | 13 ++++++++++--- + runtime/autoload/pythoncomplete.vim | 13 ++++++++++--- + runtime/doc/filetype.txt | 15 ++++++++++++++- + 4 files changed, 35 insertions(+), 7 deletions(-) + +diff --git a/runtime/autoload/README.txt b/runtime/autoload/README.txt +index 3b18d3dde..b22581963 100644 +--- a/runtime/autoload/README.txt ++++ b/runtime/autoload/README.txt +@@ -17,6 +17,7 @@ htmlcomplete.vim HTML + javascriptcomplete.vim Javascript + phpcomplete.vim PHP + pythoncomplete.vim Python ++python3complete.vim Python + rubycomplete.vim Ruby + syntaxcomplete.vim from syntax highlighting + xmlcomplete.vim XML (uses files in the xml directory) +diff --git a/runtime/autoload/python3complete.vim b/runtime/autoload/python3complete.vim +index 6894bd63e..c8d692cdd 100644 +--- a/runtime/autoload/python3complete.vim ++++ b/runtime/autoload/python3complete.vim +@@ -129,11 +129,20 @@ class Completer(object): + + def evalsource(self,text,line=0): + sc = self.parser.parse(text,line) ++ try: allow_imports = int( ++ vim.eval("get(g:, 'pythoncomplete_allow_import', 0)")) ++ except Exception: ++ allow_imports = 0 + src = sc.get_code() + dbg("source: %s" % src) + try: exec(src,self.compldict) + except: dbg("parser: %s, %s" % (sys.exc_info()[0],sys.exc_info()[1])) + for l in sc.locals: ++ # Executing import/from statements harvested from the buffer runs ++ # arbitrary package code; only do so when the user opted in. ++ if not allow_imports and (l.startswith('import') ++ or l.startswith('from ')): ++ continue + try: exec(l,self.compldict) + except: dbg("locals: %s, %s [%s]" % (sys.exc_info()[0],sys.exc_info()[1],l)) + +@@ -297,13 +306,11 @@ class Scope(object): + def get_code(self): + str = "" + if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n' +- for l in self.locals: +- if l.startswith('import'): str += l+'\n' + str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n' + for sub in self.subscopes: + str += sub.get_code() + for l in self.locals: +- if not l.startswith('import'): str += l+'\n' ++ if not l.startswith('import') and not l.startswith('from '): str += l+'\n' + + return str + +diff --git a/runtime/autoload/pythoncomplete.vim b/runtime/autoload/pythoncomplete.vim +index 5f6fee58c..f2c376f81 100644 +--- a/runtime/autoload/pythoncomplete.vim ++++ b/runtime/autoload/pythoncomplete.vim +@@ -146,11 +146,20 @@ class Completer(object): + + def evalsource(self,text,line=0): + sc = self.parser.parse(text,line) ++ try: allow_imports = int( ++ vim.eval("get(g:, 'pythoncomplete_allow_import', 0)")) ++ except Exception: ++ allow_imports = 0 + src = sc.get_code() + dbg("source: %s" % src) + try: exec(src) in self.compldict + except: dbg("parser: %s, %s" % (sys.exc_info()[0],sys.exc_info()[1])) + for l in sc.locals: ++ # Executing import/from statements harvested from the buffer runs ++ # arbitrary package code; only do so when the user opted in. ++ if not allow_imports and (l.startswith('import') ++ or l.startswith('from ')): ++ continue + try: exec(l) in self.compldict + except: dbg("locals: %s, %s [%s]" % (sys.exc_info()[0],sys.exc_info()[1],l)) + +@@ -315,13 +324,11 @@ class Scope(object): + def get_code(self): + str = "" + if len(self.docstr) > 0: str += '"""'+self.docstr+'"""\n' +- for l in self.locals: +- if l.startswith('import'): str += l+'\n' + str += 'class _PyCmplNoType:\n def __getattr__(self,name):\n return None\n' + for sub in self.subscopes: + str += sub.get_code() + for l in self.locals: +- if not l.startswith('import'): str += l+'\n' ++ if not l.startswith('import') and not l.startswith('from '): str += l+'\n' + + return str + +diff --git a/runtime/doc/filetype.txt b/runtime/doc/filetype.txt +index 318507c16..83325a40b 100644 +--- a/runtime/doc/filetype.txt ++++ b/runtime/doc/filetype.txt +@@ -658,7 +658,20 @@ By default the following options are set, in accordance with PEP8: > + To disable this behavior, set the following variable in your vimrc: > + + let g:python_recommended_style = 0 +- ++< ++Python omni-completion |compl-omni| is provided by python3complete.vim (or ++pythoncomplete.vim) for Vim builds with the |+python|/|+python3| interpreter. ++By default it does not inspect the import / from statements found in the ++buffer. This means completion of names defined in the buffer itself (classes, ++functions, variables) works, but completion of members of imported modules is ++not offered. ++ ++To enable completion of imported module members, set: > ++ let g:pythoncomplete_allow_import = 1 ++< ++WARNING: enabling this causes omni-completion to execute the import statements ++found in the buffer through Python's import machinery, which runs the imported ++modules' top-level code. Only enable this for code you trust. + + QF QUICKFIX *qf.vim* *ft-qf-plugin* + diff --git a/SOURCES/0001-patch-9.2.0568-pythoncomplete-g-pythoncomplete_allow.patch b/SOURCES/0001-patch-9.2.0568-pythoncomplete-g-pythoncomplete_allow.patch new file mode 100644 index 00000000..c702d81b --- /dev/null +++ b/SOURCES/0001-patch-9.2.0568-pythoncomplete-g-pythoncomplete_allow.patch @@ -0,0 +1,84 @@ +From ce0f5cf9a473b0ca8cd2b488d5dc159588a6c026 Mon Sep 17 00:00:00 2001 +From: thinca +Date: Sun, 31 May 2026 12:33:07 +0000 +Subject: [PATCH] patch 9.2.0568: pythoncomplete: g:pythoncomplete_allow_import + had no effect + +Problem: The security patch 9.2.0561 added a vim.eval() call inside + Completer.evalsource() to honor g:pythoncomplete_allow_import. + But the 'vim' module is only imported inside the outer + vimcomplete() / vimpy3complete() function, not at the script's + top level, so referring to it from a Completer method raises + NameError. The surrounding bare 'except' silently swallows + the error and leaves allow_imports at 0, meaning the opt-in + never takes effect -- 'import os' (and any other + buffer-level import) is always skipped, no candidates are + produced for 'os.<...>' and + Test_popup_and_preview_autocommand() fails on the Windows + CI matrix (Linux skips the test because Python 2 is absent). +Solution: Re-import 'vim' at the top of evalsource() in both + pythoncomplete.vim and python3complete.vim so the eval reads + the global, and set g:pythoncomplete_allow_import = 1 in the + test (it is the opt-in intended for callers that trust the + buffer contents) (thinca). + +closes: #20386 + +Signed-off-by: thinca +Signed-off-by: Christian Brabandt +--- + runtime/autoload/python3complete.vim | 3 +++ + runtime/autoload/pythoncomplete.vim | 3 +++ + src/testdir/test_popup.vim | 4 ++++ + 3 files changed, 10 insertions(+) + +diff --git a/runtime/autoload/python3complete.vim b/runtime/autoload/python3complete.vim +index c8d692cdd..279094f44 100644 +--- a/runtime/autoload/python3complete.vim ++++ b/runtime/autoload/python3complete.vim +@@ -128,6 +128,9 @@ class Completer(object): + self.parser = PyParser() + + def evalsource(self,text,line=0): ++ # vim is imported locally in vimpy3complete(); re-import here so the ++ # vim.eval() below works (otherwise NameError, silently caught). ++ import vim + sc = self.parser.parse(text,line) + try: allow_imports = int( + vim.eval("get(g:, 'pythoncomplete_allow_import', 0)")) +diff --git a/runtime/autoload/pythoncomplete.vim b/runtime/autoload/pythoncomplete.vim +index f2c376f81..8986edffc 100644 +--- a/runtime/autoload/pythoncomplete.vim ++++ b/runtime/autoload/pythoncomplete.vim +@@ -145,6 +145,9 @@ class Completer(object): + self.parser = PyParser() + + def evalsource(self,text,line=0): ++ # vim is imported locally in vimcomplete(); re-import here so the ++ # vim.eval() below works (otherwise NameError, silently caught). ++ import vim + sc = self.parser.parse(text,line) + try: allow_imports = int( + vim.eval("get(g:, 'pythoncomplete_allow_import', 0)")) +diff --git a/src/testdir/test_popup.vim b/src/testdir/test_popup.vim +index c8f8820af..894e2ff1e 100644 +--- a/src/testdir/test_popup.vim ++++ b/src/testdir/test_popup.vim +@@ -708,6 +708,9 @@ func Test_popup_and_preview_autocommand() + au! + au BufAdd * nested tab sball + augroup END ++ " Let pythoncomplete follow the buffer's 'import os' (off by default ++ " since v9.2.0561) so 'os.' can be completed. ++ let g:pythoncomplete_allow_import = 1 + set omnifunc=pythoncomplete#Complete + call setline(1, 'import os') + " make the line long +@@ -730,6 +733,7 @@ func Test_popup_and_preview_autocommand() + augroup END + augroup! MyBufAdd + bw! ++ unlet g:pythoncomplete_allow_import + endfunc + + func Test_popup_and_previewwindow_dump() diff --git a/SPECS/vim.spec b/SPECS/vim.spec index e6835479..fe72b7a0 100644 --- a/SPECS/vim.spec +++ b/SPECS/vim.spec @@ -27,7 +27,7 @@ Summary: The VIM editor URL: http://www.vim.org/ Name: vim Version: %{baseversion}.%{patchlevel} -Release: 26%{?dist}.6 +Release: 26%{?dist}.10 License: Vim and MIT Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2 Source1: virc @@ -196,6 +196,41 @@ Patch3070: 0001-patch-9.2.0304-zip-block-absolute-paths-in-Extract.patch # https://redhat.atlassian.net/browse/RHEL-171495 # https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb Patch3071: 0001-patch-9.2.0357-security-command-injection-via-backti.patch +# RHEL-178243 CVE-2026-46483 runtime(tar): command injection in tar plugin +# https://redhat.atlassian.net/browse/RHEL-178243 +# https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1 +# Omitted src/version.c changes per downstream policy +# Omitted 'Last Change' comments in tar.vim per downstream policy +# Reduced test file to only Test_extract_command_injection +# Added Make_all.mak changes from upstream commit 87757c6b0a4 +# Added sourcing of check.vim in test file - defines Check* functions, +# needed to explicitly specify in older Vim +Patch3072: 0001-patch-9.2.0479-security-runtime-tar-command-injectio.patch +# RHEL-185874 CVE-2026-47167 vim: Code Injection in cucumber filetype plugin +# https://redhat.atlassian.net/browse/RHEL-185874 +# https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934 +# Omitted src/version.c changes per downstream policy +# Omitted 'Last Change' comments in cucumber.vim per downstream policy +Patch3073: 0001-patch-9.2.0496-security-Code-Injection-in-cucumber-f.patch +# RHEL-186646 CVE-2026-52858 [security]: possible code execution with python3complete +# https://redhat.atlassian.net/browse/RHEL-186646 +# https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d +# Omitted src/version.c changes per downstream policy +# Omitted 'Last Changes' comments in python3complete.vim and pythoncomplete.vim per downstream policy +Patch3074: 0001-patch-9.2.0561-security-possible-code-execution-with.patch +# RHEL-186646 CVE-2026-52858 pythoncomplete: g:pythoncomplete_allow_import had no effect +# https://redhat.atlassian.net/browse/RHEL-186646 +# https://github.com/vim/vim/commit/868ad62cb8bf8038322eab2badd31bd98b02b9df +# Omitted src/version.c changes per downstream policy +Patch3075: 0001-patch-9.2.0568-pythoncomplete-g-pythoncomplete_allow.patch +# RHEL-186659 CVE-2026-47162 vim: code injection via NetrwBookHistSave() +# https://redhat.atlassian.net/browse/RHEL-186659 +# https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b +# Omitted src/version.c changes per downstream policy +# Applied fix to runtime/autoload/netrw.vim (RHEL path) instead of runtime/pack/dist/opt/netrw/autoload/netrw.vim +# Created new test file test_plugin_netrw.vim with minimal test +# Added test_plugin_netrw to Make_all.mak +Patch3076: 0001-patch-9.2.0495-security-runtime-netrw-code-injection.patch # gcc is no longer in buildroot by default @@ -455,6 +490,11 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk %patch -P 3069 -p1 -b .zip-abs-write %patch -P 3070 -p1 -b .zip-abs-extract %patch -P 3071 -p1 -b .tag-backtick-inject +%patch -P 3072 -p1 -b .tar-cmd-inject +%patch -P 3073 -p1 -b .cucumber-code-inject +%patch -P 3074 -p1 -b .python3complete-code-exec +%patch -P 3075 -p1 -b .pythoncomplete-allow-import +%patch -P 3076 -p1 -b .netrw-code-inject %build cd src @@ -1007,6 +1047,20 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags %endif %changelog +* Wed Jul 01 2026 RHEL Packaging Agent - 2:8.2.2637-26.10 +- RHEL-186659 CVE-2026-47162 vim: code injection via + NetrwBookHistSave() + +* Wed Jul 01 2026 RHEL Packaging Agent - 2:8.2.2637-26.9 +- RHEL-186646 CVE-2026-52858 vim: possible code execution with + python3complete + +* Mon Jun 22 2026 RHEL Packaging Agent - 2:8.2.2637-26.8 +- RHEL-185874 CVE-2026-47167 vim: Code Injection in cucumber filetype plugin + +* Thu May 28 2026 RHEL Packaging Agent - 2:8.2.2637-26.7 +- RHEL-178243 CVE-2026-46483 vim: command injection in tar plugin + * Thu May 21 2026 Zdenek Dohnal - 2:8.2.2637-26.6 - CVE-2026-41411 vim: Command injection via backticks in tag files