Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-73076 →
UBUNTU-CVE-2026-73076
Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Ubuntu:Pro:14.04:LTS
vim
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.052-1ubuntu3.1+esm32"}]}]
Ubuntu:Pro:16.04:LTS
vim
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.1689-3ubuntu1.5+esm38"}]}]
Ubuntu:Pro:18.04:LTS
vim
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+esm23"}]}]
Ubuntu:Pro:20.04:LTS
vim
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.2269-1ubuntu5.32+esm12"}]}]
Ubuntu:22.04:LTS
vim
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.3995-1ubuntu2.35"}]}]
Ubuntu:24.04:LTS
vim
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.0016-1ubuntu7.19"}]}]
Ubuntu:26.04:LTS
vim
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.2141-1ubuntu4.8"}]}]
Références
- advisory ubuntu.com
- report ubuntu.com
- report cve.org
- report github.com
- report github.com