vim-8.0.1763-31.el8_10.ML.1
エラータID: AXSA:2026-1446:20
リリース日:
2026/08/04 Tuesday - 17:18
題名:
vim-8.0.1763-31.el8_10.ML.1
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Vim の tree_count_words() 関数には、メモリ領域の範囲外
書き込みの問題があるため、ローカルの攻撃者により、情報の漏洩、
データ破壊、およびサービス拒否攻撃を可能とする脆弱性が存在します。
(CVE-2026-55693)
- Vim の spell_soundfold_sofo() 関数には、メモリ領域の範囲外
書き込みの問題があるため、ローカルの攻撃者により、サービス拒否
攻撃 (クラッシュの発生) を可能とする脆弱性が存在します。
(CVE-2026-57455)
- Vim の Python 向けの補完機能には、ローカルの攻撃者により、
任意のコードの実行を可能とする脆弱性が存在します。
(CVE-2026-57456)
- Vim の C 言語用 omni-completion スクリプトには、ローカルの
攻撃者により、任意のコードの実行を可能とする脆弱性が存在します。
(CVE-2026-59858)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2026-55693
Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.
Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.
CVE-2026-57455
Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file's SOFO (sound-folding) byte map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via sound-based spell suggestion) while a SOFO-based spell language is active, therefore writes past the end of that buffer. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0698.
Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file's SOFO (sound-folding) byte map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via sound-based spell suggestion) while a SOFO-based spell language is active, therefore writes past the end of that buffer. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0698.
CVE-2026-57456
Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. When reconstructing that source, each scope's docstring is inserted verbatim between triple quotes with no escaping, so a hostile buffer can break out of the triple-quoted literal and execute attacker-controlled Python during omni-completion. This vulnerability is fixed in 9.2.0699.
Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. When reconstructing that source, each scope's docstring is inserted verbatim between triple quotes with no escaping, so a hostile buffer can break out of the triple-quoted literal and execute attacker-controlled Python during omni-completion. This vulnerability is fixed in 9.2.0699.
CVE-2026-59858
Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.
Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.
追加情報:
N/A
ダウンロード:
SRPMS
- vim-8.0.1763-31.el8_10.ML.1.src.rpm
MD5: d5480204379a01252b7e4dced5600da2
SHA-256: 96b2ff8953ba820b192b9eee2dba711296f529c3d5bd66cabbbd3de5b9c28e57
Size: 10.76 MB
Asianux Server 8 for x86_64
- vim-common-8.0.1763-31.el8_10.ML.1.x86_64.rpm
MD5: 876b63927ef966ca1546c4e9fb379210
SHA-256: 78105b73de92780c138cfa2950586c7566a9353417cfe23bc70f63da40ad4251
Size: 6.34 MB - vim-enhanced-8.0.1763-31.el8_10.ML.1.x86_64.rpm
MD5: e06c90c6c317f4af51271cec7fb18a0c
SHA-256: bad98ab0a3d097b33c8ec2f413974842474c2e8703ee0ca2f8da2aec60c19a02
Size: 1.36 MB - vim-filesystem-8.0.1763-31.el8_10.ML.1.noarch.rpm
MD5: 7122d164b10d7d4a53a0b3f870b28a6c
SHA-256: b8ad879efc2bde792590e94122145ad643bce0d71ebfd3ab92fc9d95ec467595
Size: 51.87 kB - vim-minimal-8.0.1763-31.el8_10.ML.1.x86_64.rpm
MD5: 627de4a362e3a469de8973df46c3c964
SHA-256: 19b75e334c963904d2fddb613b9c5633c7669da2a1781f9e834029dd25465644
Size: 576.74 kB - vim-X11-8.0.1763-31.el8_10.ML.1.x86_64.rpm
MD5: 714700b891d1b2ae19bef67f5c1bea9d
SHA-256: f4fb4e673022a84f8a1677b0e0ad471863fb38585cbf537f5caae104bf8f2608
Size: 1.50 MB
English