vim (2:8.2.3995-1ubuntu2.33) jammy-security; urgency=medium

  * SECURITY UPDATE: Path Traversal in zip.vim
    - debian/patches/CVE-2026-35177.patch: Detect malicious zip files before
      writing in runtime/autoload/zip.vim
    - CVE-2026-35177
  * SECURITY UPDATE: Out-of-bounds write.
    - debian/patches/CVE-2026-55693.patch: only descend while
      depth < MAXWLEN - 1 in src/spellfile.c.
    - debian/patches/CVE-2026-55892.patch: only descend while
      depth < MAXWLEN - 1 in src/spell.c.
    - CVE-2026-55693
    - CVE-2026-55892
  * SECURITY UPDATE: Code injection in local file deletion.
    - debian/patches/CVE-2026-55895.patch: Use fnameescape() to escape
      file name in runtime/autoload/netrw.vim.
    - CVE-2026-55895
  * SECURITY UPDATE: Out-of-bounds read with sodium encrypted files.
    - debian/patches/CVE-2026-57452.patch: Verify that there is enough space
      before function call in src/crypt.c.
    - CVE-2026-57452
  * SECURITY UPDATE: Out-of-bounds write with soundfold().
    - debian/patches/CVE-2026-57455.patch: Add an abort condition to validate
      buffer in src/spell.c.
    - CVE-2026-57455
  * SECURITY UPDATE: Code execution with python complete.
    - debian/patches/CVE-2026-57456.patch: Use repr() to quote the doc strings
      in runtime/autoload/python3complete.vim and ../pythoncomplete.vim.
    - CVE-2026-57456

 -- Kyle Kernick <kyle.kernick@canonical.com>  Tue, 30 Jun 2026 11:46:22 -0600

vim (2:8.2.3995-1ubuntu2.32) jammy-security; urgency=medium

  * SECURITY UPDATE: Code injection via NetrwBookHistSave().
    - debian/patches/CVE-2026-47162.patch: Properly quote the directory name
      in runtime/autoload/netrw.vim.
    - CVE-2026-47162
  * SECURITY UPDATE: Code Injection in cucumber filetype plugin.
    - debian/patches/CVE-2026-47167.patch: Use rubys Regexp.new() in
      runtime/ftplugin/cucumber.vim.
    - CVE-2026-47167
  * SECURITY UPDATE: Code execution with python3complete.
    - debian/patches/CVE-2026-52858.patch: Disable execution of import/from
      statements in runtime/autoload/python3complete.vim and
      ../pythoncomplete.vim
    - debian/patches/CVE-2026-52860.patch: Strip default expressions and
      annotations in runtime/autoload/python3complete.vim and
      ../pythoncomplete.vim
    - CVE-2026-52858
    - CVE-2026-52860
  * SECURITY UPDATE: Out-of-bounds read in update_snapshot().
    - debian/patches/CVE-2026-52859.patch: Bound loop in handle_pushline() in
      src/terminal.c.
    - CVE-2026-52859

 -- Kyle Kernick <kyle.kernick@canonical.com>  Mon, 15 Jun 2026 16:18:48 -0600

vim (2:8.2.3995-1ubuntu2.31) jammy-security; urgency=medium

  * SECURITY UPDATE: Command injection in tar plugin.
    - debian/patches/CVE-2026-46483.patch: Use the correct shell-escape in
      runtime/autoload/tar.vim.
    - CVE-2026-46483
  * SECURITY UPDATE: Code injection via mf command.
    - debian/patches/CVE-2026-43961.patch: Avoid string concatenation for
      filter commands in runtime/autoload/netrw.vim.
    - CVE-2026-43961

 -- Kyle Kernick <kyle.kernick@canonical.com>  Wed, 03 Jun 2026 10:41:25 -0600

vim (2:8.2.3995-1ubuntu2.30) jammy-security; urgency=medium

  * SECURITY UPDATE: Command injection in netrw plugin.
    - debian/patches/CVE-2026-42307.patch: Escape file names and harden regex
      patterns in runtime/autoload/netrw.vim
    - CVE-2026-42307
  * SECURITY UPDATE: Shell execution in completion.
    - debian/patches/CVE-2026-44656.patch: Skip path entries containing
      backticks and add P_SECURE option in src/findfile.c and src/optiondefs.h
    - CVE-2026-44656
  * SECURITY UPDATE: Heap overflow in spellfile.
    - debian/patches/CVE-2026-45130.patch: Enforce a maximum compound length
      in src/spellfile.c
    - CVE-2026-45130

 -- Kyle Kernick <kyle.kernick@canonical.com>  Wed, 20 May 2026 15:28:11 -0600

vim (2:8.2.3995-1ubuntu2.29) jammy-security; urgency=medium

  * SECURITY UPDATE: Command injection via backtick expansion in tag files
    - debian/patches/CVE-2026-41411.patch: Disallow backticks before attempting
      to expand filenames
    - CVE-2026-41411

 -- Federico Quattrin <federico.quattrin@canonical.com>  Wed, 06 May 2026 13:56:18 -0300

vim (2:8.2.3995-1ubuntu2.28) jammy-security; urgency=medium

  * SECURITY UPDATE: Command Injection in netbeans
    - debian/patches/CVE-2026-39881.patch: Validate typename, fg, and bg
      before passing to coloncmd in src/netbeans.c
    - CVE-2026-39881

 -- Kyle Kernick <kyle.kernick@canonical.com>  Wed, 22 Apr 2026 12:21:19 -0600

vim (2:8.2.3995-1ubuntu2.27) jammy-security; urgency=medium

  * SECURITY UPDATE: Command injection in glob.
    - debian/patches/CVE-2026-33412.patch: Add newline to SHELL_SPECIAL in
      src/os_unix.c.
    - CVE-2026-33412
  * SECURITY UPDATE: Security bypass in modeline.
    - debian/patches/CVE-2026-34982.patch: Disallow modeset while in secure
       mode in src/optiondefs.h.
    - CVE-2026-34982

 -- Kyle Kernick <kyle.kernick@canonical.com>  Mon, 06 Apr 2026 14:13:36 -0600

vim (2:8.2.3995-1ubuntu2.26) jammy-security; urgency=medium

  * SECURITY UPDATE: Buffer Overflow
    - debian/patches/CVE-2026-26269.patch: Limit writing to max KEYBUFLEN
      bytes to prevent writing out of bounds.
    - debian/patches/CVE-2026-28420.patch: Use VTERM_MAX_CHARS_PER_CELL * 4
      for ga_grow() to ensure sufficient space. Add a boundary check to the
      character loop to prevent index out-of-bounds access.
    - debian/patches/CVE-2026-28422.patch: Update the size check to account
      for the byte length of the fill character (using MB_CHAR2LEN).
    - debian/patches/CVE-2026-25749.patch: Limit strncpy to the length
      of the buffer (MAXPATHL)
    - CVE-2026-26269
    - CVE-2026-28420
    - CVE-2026-28422
    - CVE-2026-25749
  * SECURITY UPDATE: Command Injection
    - debian/patches/CVE-2026-28417.patch: Implement stricter RFC1123
      hostname and IP validation. Use shellescape() for the provided
      hostname and port.
    - CVE-2026-28417
  * SECURITY UPDATE: Out of Bounds Read
    - debian/patches/CVE-2026-28418.patch: Check for end of buffer
      and return early.
    - CVE-2026-28418
  * SECURITY UPDATE: Buffer Underflow
    - debian/patches/CVE-2026-28419.patch: Add a check to ensure the
      delimiter (p_7f) is not at the start of the buffer (lbuf) before
      attempting to isolate the tag name.
    - CVE-2026-28419
  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2026-28421.patch: Add bounds checks on
      pe_page_count and pe_bnum against mf_blocknr_max before descending
      into the block tree, and validate pe_old_lnum >= 1 and
      pe_line_count > 0 before calling readfile().
    - CVE-2026-28421

 -- Bruce Cable <bruce.cable@canonical.com>  Wed, 11 Mar 2026 10:44:44 +1100

vim (2:8.2.3995-1ubuntu2.24) jammy-security; urgency=medium

  * SECURITY UPDATE: Use after free when redirecting display command to
    register.
    - debian/patches/CVE-2025-26603.patch: Change redir_reg check to use
      vim_strchr command check in ./src/register.c.
    - CVE-2025-26603

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Wed, 02 Apr 2025 10:09:01 -0230

vim (2:8.2.3995-1ubuntu2.23) jammy-security; urgency=medium

  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2025-24014.patch: fix a segfault in win_line()
      in files src/gui.c, src/testdir/crash/ex_redraw_crash,
      src/testdir/test_crash.vim.
    - CVE-2025-24014

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Mon, 03 Feb 2025 08:54:38 -0300

# For older changelog entries, run 'apt-get changelog vim-athena'
