Mageia alert MGASA-2026-0167 (vim)
| From: | Mageia Updates <updates-announce@ml.mageia.org> | |
| To: | updates-announce@ml.mageia.org | |
| Subject: | [updates-announce] MGASA-2026-0167: Updated vim packages fix security vulnerabilities | |
| Date: | Sat, 30 May 2026 07:08:37 +0200 | |
| Message-ID: | <20260530050837.BAF59A0E13@duvel.mageia.org> | |
| Archive-link: | Article |
MGASA-2026-0167 - Updated vim packages fix security vulnerabilities Publication date: 30 May 2026 URL: https://advisories.mageia.org/MGASA-2026-0167.html Type: security Affected Mageia releases: 9 CVE: CVE-2026-45130, CVE-2026-43961, CVE-2026-46483 Description: Heap Buffer Overflow in spell file loading affects Vim < 9.2.0450. (CVE-2026-45130) Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename affects Vim < 9.2.0480. (CVE-2026-43961) Command Injection in tar.vim affects Vim < 9.2.0479. (CVE-2026-46483) Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name affects Vim < 9.2.0495. Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex affects Vim < 9.2.0496. References: - https://bugs.mageia.org/show_bug.cgi?id=35490 - https://www.openwall.com/lists/oss-security/2026/05/07/9 - https://github.com/vim/vim/security/advisories/GHSA-q4jv-... - https://www.openwall.com/lists/oss-security/2026/05/14/6 - https://github.com/vim/vim/security/advisories/GHSA-2fpv-... - https://www.openwall.com/lists/oss-security/2026/05/14/7 - https://github.com/vim/vim/security/advisories/GHSA-66hr-... - https://www.openwall.com/lists/oss-security/2026/05/17/3 - https://github.com/vim/vim/security/advisories/GHSA-crm5-... - https://www.openwall.com/lists/oss-security/2026/05/17/4 - https://github.com/vim/vim/security/advisories/GHSA-4473-... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4... - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4... SRPMS: - 9/core/vim-9.2.498-1.mga9