UbuntuUpdates.org

Package "vim"

Name: vim

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • Vi IMproved - enhanced vi editor - with Athena GUI
  • Vi IMproved - enhanced vi editor (dummy package)
  • Vi IMproved - enhanced vi editor - with GTK3 GUI
  • Vi IMproved - Common GUI files
Latest version: 2:8.2.3995-1ubuntu2.31
Release: jammy (22.04)
Level: security
Repository: universe

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "vim" in Jammy

Repository Area Version
base main 2:8.2.3995-1ubuntu2
base universe 2:8.2.3995-1ubuntu2
security main 2:8.2.3995-1ubuntu2.31
updates universe 2:8.2.3995-1ubuntu2.30
updates main 2:8.2.3995-1ubuntu2.30

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 2:8.2.3995-1ubuntu2.31 2026-06-09 20:07:29 UTC
No changelog available yet.
Source diff to previous version

Version: 2:8.2.3995-1ubuntu2.30 2026-05-25 19:07:27 UTC

  vim (2:8.2.3995-1ubuntu2.30) jammy-security; urgency=medium

  * SECURITY UPDATE: Command injection in netrw plugin.
    - debian/patches/CVE-2026-42307.patch: Escape file names and harden regex
      patterns in runtime/autoload/netrw.vim
    - CVE-2026-42307
  * SECURITY UPDATE: Shell execution in completion.
    - debian/patches/CVE-2026-44656.patch: Skip path entries containing
      backticks and add P_SECURE option in src/findfile.c and src/optiondefs.h
    - CVE-2026-44656
  * SECURITY UPDATE: Heap overflow in spellfile.
    - debian/patches/CVE-2026-45130.patch: Enforce a maximum compound length
      in src/spellfile.c
    - CVE-2026-45130

 -- Kyle Kernick <email address hidden> Wed, 20 May 2026 15:28:11 -0600
Source diff to previous version
CVE-2026-42307 Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin
CVE-2026-44656 Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line
CVE-2026-45130 Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when

Version: 2:8.2.3995-1ubuntu2.29 2026-05-07 19:07:41 UTC

  vim (2:8.2.3995-1ubuntu2.29) jammy-security; urgency=medium

  * SECURITY UPDATE: Command injection via backtick expansion in tag files
    - debian/patches/CVE-2026-41411.patch: Disallow backticks before attempting
      to expand filenames
    - CVE-2026-41411

 -- Federico Quattrin <email address hidden> Wed, 06 May 2026 13:56:18 -0300
Source diff to previous version
CVE-2026-41411 Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resol

Version: 2:8.2.3995-1ubuntu2.28 2026-04-27 21:08:48 UTC

  vim (2:8.2.3995-1ubuntu2.28) jammy-security; urgency=medium

  * SECURITY UPDATE: Command Injection in netbeans
    - debian/patches/CVE-2026-39881.patch: Validate typename, fg, and bg
      before passing to coloncmd in src/netbeans.c
    - CVE-2026-39881

 -- Kyle Kernick <email address hidden> Wed, 22 Apr 2026 12:21:19 -0600
Source diff to previous version
CVE-2026-39881 Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious

Version: 2:8.2.3995-1ubuntu2.27 2026-04-15 05:08:10 UTC

  vim (2:8.2.3995-1ubuntu2.27) jammy-security; urgency=medium

  * SECURITY UPDATE: Command injection in glob.
    - debian/patches/CVE-2026-33412.patch: Add newline to SHELL_SPECIAL in
      src/os_unix.c.
    - CVE-2026-33412
  * SECURITY UPDATE: Security bypass in modeline.
    - debian/patches/CVE-2026-34982.patch: Disallow modeset while in secure
       mode in src/optiondefs.h.
    - CVE-2026-34982

 -- Kyle Kernick <email address hidden> Mon, 06 Apr 2026 14:13:36 -0600
CVE-2026-33412 Vim is an open source, command line text editor. Prior to version 9.2.0202, a command injection vulnerability exists in Vim's glob() function on Unix
CVE-2026-34982 Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution wh


About   -   Send Feedback to @ubuntu_updates