vim (2:8.2.3995-1ubuntu2.36) jammy-security; urgency=medium

  * SECURITY UPDATE: Arbitrary command execution during C omni-completion.
    - debian/patches/CVE-2026-73073.patch: Match tags typeref literally in
      runtime/autoload/ccomplete.vim.
    - CVE-2026-73073

 -- Kyle Kernick <kyle.kernick@canonical.com>  Mon, 24 Aug 2026 16:13:24 -0600

vim (2:8.2.3995-1ubuntu2.35) jammy-security; urgency=medium

  * SECURITY REGRESSION: Incomplete fix for CVE-2026-28417 (LP: #2163785)
    - debian/patches/CVE-2026-28417-pre1.patch: Add NetrwValidateHostname in
      runtime/autoload/netrw.vim
    - debian/patches/CVE-2026-28417.patch: Add fixes to NetrwValidateHostname
      in runtime/autoload/netrw.vim
  * SECURITY UPDATE: Use-after-free on json decode error.
    - debian/patches/CVE-2026-73071.patch: Report the position from the
      current reader in src/json.c.
    - CVE-2026-73071
  * SECURITY UPDATE: Heap buffer overflow in set_sofo().
    - debian/patches/CVE-2026-73072.patch: Reset sl_sal_first in
      src/spellfile.c.
    - CVE-2026-73072
  * SECURITY UPDATE: Heap overflow when adding > 65535 text properties.
    - debian/patches/CVE-2026-73074.patch: Verify that the number of text
      properties falls within the limit in src/errors.h and src/textprop.c.
    - CVE-2026-73074
  * SECURITY UPDATE: Code execution via VimballRecord file.
    - debian/patches/CVE-2026-73076.patch: Forbid arbitrary commands, fix
      broken directory deletion code, and refactor code in
      runtime/autoload/vimball.vim
    - CVE-2026-73076
  * SECURITY UPDATE: Arbitrary code execution via keyword lookup.
    - debian/patches/CVE-2026-73077.patch: For powershell, quote the commands
      using single quotes, for zsh pass the argument as a separate list
      item to term_start()/system() in runtime/ftplugin/ps1.vim and
      ../zsh.vim.
    - CVE-2026-73077
  * SECURITY UPDATE: Code injection in netrw via bookmarks.
    - debian/patches/CVE-2026-73078.patch: Escape the '|' explicitly in
      runtime/autoload/netrw.vim.
    - CVE-2026-73078

 -- Kyle Kernick <kyle.kernick@canonical.com>  Tue, 18 Aug 2026 15:47:19 -0600

vim (2:8.2.3995-1ubuntu2.34) jammy-security; urgency=medium

  * SECURITY UPDATE: Command execution in PHP omni-completion.
    - debian/patches/CVE-2026-59856.patch: Quote the class name before
      inserting it into the search() in runtime/autoload/phpcomplete.vim
    - CVE-2026-59856
  * SECURITY UPDATE: Stack out-of-bounds write in spell_soundfold_sal().
    - debian/patches/CVE-2026-59857.patch: Bound the single-byte SAL result
      writes in src/spell.c
    - CVE-2026-59857
  * SECURITY UPDATE: Arbitrary command execution during C omni-completion.
    - debian/patches/CVE-2026-59858.patch: Escape the type field before
      inserting it into pattern in runtime/autoload/ccomplete.vim
    - CVE-2026-59858

 -- Kyle Kernick <kyle.kernick@canonical.com>  Mon, 13 Jul 2026 13:08:21 -0600

vim (2:8.2.3995-1ubuntu2.33) jammy-security; urgency=medium

  * SECURITY UPDATE: Path Traversal in zip.vim
    - debian/patches/CVE-2026-35177.patch: Detect malicious zip files before
      writing in runtime/autoload/zip.vim
    - CVE-2026-35177
  * SECURITY UPDATE: Out-of-bounds write.
    - debian/patches/CVE-2026-55693.patch: only descend while
      depth < MAXWLEN - 1 in src/spellfile.c.
    - debian/patches/CVE-2026-55892.patch: only descend while
      depth < MAXWLEN - 1 in src/spell.c.
    - CVE-2026-55693
    - CVE-2026-55892
  * SECURITY UPDATE: Code injection in local file deletion.
    - debian/patches/CVE-2026-55895.patch: Use fnameescape() to escape
      file name in runtime/autoload/netrw.vim.
    - CVE-2026-55895
  * SECURITY UPDATE: Out-of-bounds read with sodium encrypted files.
    - debian/patches/CVE-2026-57452.patch: Verify that there is enough space
      before function call in src/crypt.c.
    - CVE-2026-57452
  * SECURITY UPDATE: Out-of-bounds write with soundfold().
    - debian/patches/CVE-2026-57455.patch: Add an abort condition to validate
      buffer in src/spell.c.
    - CVE-2026-57455
  * SECURITY UPDATE: Code execution with python complete.
    - debian/patches/CVE-2026-57456.patch: Use repr() to quote the doc strings
      in runtime/autoload/python3complete.vim and ../pythoncomplete.vim.
    - CVE-2026-57456

 -- Kyle Kernick <kyle.kernick@canonical.com>  Tue, 30 Jun 2026 11:46:22 -0600

vim (2:8.2.3995-1ubuntu2.32) jammy-security; urgency=medium

  * SECURITY UPDATE: Code injection via NetrwBookHistSave().
    - debian/patches/CVE-2026-47162.patch: Properly quote the directory name
      in runtime/autoload/netrw.vim.
    - CVE-2026-47162
  * SECURITY UPDATE: Code Injection in cucumber filetype plugin.
    - debian/patches/CVE-2026-47167.patch: Use rubys Regexp.new() in
      runtime/ftplugin/cucumber.vim.
    - CVE-2026-47167
  * SECURITY UPDATE: Code execution with python3complete.
    - debian/patches/CVE-2026-52858.patch: Disable execution of import/from
      statements in runtime/autoload/python3complete.vim and
      ../pythoncomplete.vim
    - debian/patches/CVE-2026-52860.patch: Strip default expressions and
      annotations in runtime/autoload/python3complete.vim and
      ../pythoncomplete.vim
    - CVE-2026-52858
    - CVE-2026-52860
  * SECURITY UPDATE: Out-of-bounds read in update_snapshot().
    - debian/patches/CVE-2026-52859.patch: Bound loop in handle_pushline() in
      src/terminal.c.
    - CVE-2026-52859

 -- Kyle Kernick <kyle.kernick@canonical.com>  Mon, 15 Jun 2026 16:18:48 -0600

vim (2:8.2.3995-1ubuntu2.31) jammy-security; urgency=medium

  * SECURITY UPDATE: Command injection in tar plugin.
    - debian/patches/CVE-2026-46483.patch: Use the correct shell-escape in
      runtime/autoload/tar.vim.
    - CVE-2026-46483
  * SECURITY UPDATE: Code injection via mf command.
    - debian/patches/CVE-2026-43961.patch: Avoid string concatenation for
      filter commands in runtime/autoload/netrw.vim.
    - CVE-2026-43961

 -- Kyle Kernick <kyle.kernick@canonical.com>  Wed, 03 Jun 2026 10:41:25 -0600

vim (2:8.2.3995-1ubuntu2.30) jammy-security; urgency=medium

  * SECURITY UPDATE: Command injection in netrw plugin.
    - debian/patches/CVE-2026-42307.patch: Escape file names and harden regex
      patterns in runtime/autoload/netrw.vim
    - CVE-2026-42307
  * SECURITY UPDATE: Shell execution in completion.
    - debian/patches/CVE-2026-44656.patch: Skip path entries containing
      backticks and add P_SECURE option in src/findfile.c and src/optiondefs.h
    - CVE-2026-44656
  * SECURITY UPDATE: Heap overflow in spellfile.
    - debian/patches/CVE-2026-45130.patch: Enforce a maximum compound length
      in src/spellfile.c
    - CVE-2026-45130

 -- Kyle Kernick <kyle.kernick@canonical.com>  Wed, 20 May 2026 15:28:11 -0600

vim (2:8.2.3995-1ubuntu2.29) jammy-security; urgency=medium

  * SECURITY UPDATE: Command injection via backtick expansion in tag files
    - debian/patches/CVE-2026-41411.patch: Disallow backticks before attempting
      to expand filenames
    - CVE-2026-41411

 -- Federico Quattrin <federico.quattrin@canonical.com>  Wed, 06 May 2026 13:56:18 -0300

vim (2:8.2.3995-1ubuntu2.28) jammy-security; urgency=medium

  * SECURITY UPDATE: Command Injection in netbeans
    - debian/patches/CVE-2026-39881.patch: Validate typename, fg, and bg
      before passing to coloncmd in src/netbeans.c
    - CVE-2026-39881

 -- Kyle Kernick <kyle.kernick@canonical.com>  Wed, 22 Apr 2026 12:21:19 -0600

vim (2:8.2.3995-1ubuntu2.27) jammy-security; urgency=medium

  * SECURITY UPDATE: Command injection in glob.
    - debian/patches/CVE-2026-33412.patch: Add newline to SHELL_SPECIAL in
      src/os_unix.c.
    - CVE-2026-33412
  * SECURITY UPDATE: Security bypass in modeline.
    - debian/patches/CVE-2026-34982.patch: Disallow modeset while in secure
       mode in src/optiondefs.h.
    - CVE-2026-34982

 -- Kyle Kernick <kyle.kernick@canonical.com>  Mon, 06 Apr 2026 14:13:36 -0600

# For older changelog entries, run 'apt-get changelog vim'
