Most recent entries from all

ALSA-2026:4442 — Moderate: vim security update

2026-10-02T14:31:43.920773+00:00

Affected: AlmaLinux:8: vim-X11, AlmaLinux:8: vim-common, AlmaLinux:8: vim-enhanced, AlmaLinux:8: vim-filesystem, AlmaLinux:8: vim-minimal

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

* vim: Vim: Arbitrary code execution via 'helpfile' option processing (CVE-2026-25749)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-05072

2026-10-02T14:31:43.920851+00:00

bdu:2026-05072

BELL-CVE-2026-25749

2026-10-02T14:31:43.920869+00:00

Affected: Alpaquita:23: vim, Alpaquita:25: vim, Alpaquita:stream: vim

certfr-2026-avi-0316 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

2026-10-02T14:31:43.920891+00:00

certfr-2026-avi-0316

EUVD-2026-267660

2026-10-02T14:31:43.920907+00:00

EUVD-2026-267660

fkie_cve-2026-25749

2026-10-02T14:31:43.920917+00:00

Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been patched in version 9.1.2132.

OESA-2026-1365 — vim security update

2026-10-02T14:31:43.920942+00:00

Affected: openEuler:24.03-LTS-SP2: vim, openEuler:24.03-LTS-SP3: vim, openEuler:20.03-LTS-SP4: vim, openEuler:22.03-LTS-SP4: vim, openEuler:24.03-LTS: vim, openEuler:24.03-LTS-SP1: vim

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems. Security Fix(es):

RHSA-2026:10065 — Red Hat Security Advisory: Red Hat Update Infrastructure 5.1 security update

2026-10-02T14:31:43.920977+00:00

libxslt: Processing web content may disclose sensitive information nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing python: Python: Command-line option injection in webbrowser.open() via crafted URLs libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing net/url: Incorrect parsing of IPv6 host literals in net/url vim: Vim: Arbitrary code execution via 'helpfile' option processing nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin vim: Vim: Denial of service and information disclosure via crafted swap file nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files vim: Vim: Arbitrary code execution via command injection in glob() function

RHSA-2026:4442 — Red Hat Security Advisory: vim security update

2026-10-02T14:31:43.921028+00:00

vim: Vim: Arbitrary code execution via 'helpfile' option processing

UBUNTU-CVE-2026-25749

2026-10-02T14:31:43.921045+00:00

Affected: Ubuntu:Pro:14.04:LTS: vim, Ubuntu:Pro:16.04:LTS: vim, Ubuntu:Pro:18.04:LTS: vim, Ubuntu:Pro:20.04:LTS: vim, Ubuntu:22.04:LTS: vim, Ubuntu:24.04:LTS: vim, Ubuntu:25.10: vim

WID-SEC-W-2026-0335 — vim: Schwachstelle ermöglicht Codeausführung

2026-10-02T14:31:43.921076+00:00

Ein lokaler Angreifer kann eine Schwachstelle in vim ausnutzen, um eine Speicherbeschädigung zu verursachen, beliebigen Code auszuführen oder einen Denial-of-Service-Zustand herbeizuführen.