From patchwork Thu Jul 23 09:23:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Siddharth X-Patchwork-Id: 93329 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 124A7C531C7 for ; Thu, 23 Jul 2026 09:26:07 +0000 (UTC) Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.19523.1784798763386650397 for ; Thu, 23 Jul 2026 02:26:03 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@mvista.com header.s=google header.b=WZ4sSs2Z; spf=pass (domain: mvista.com, ip: 209.85.214.173, mailfrom: sdoshi@mvista.com) Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-2ceb096e675so5012615ad.0 for ; Thu, 23 Jul 2026 02:26:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mvista.com; s=google; t=1784798763; x=1785403563; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=C2EtZm5n8do9wevKtSVXp/o4265+P0TBGlYyPhKLrmE=; b=WZ4sSs2Zdtxe5talsGdwd0RxUWrVWH6b2Swol83EusjurOVjTOPpQtwQjGuIjSN3yi bEVQoF6Ozm3areH8MmcSDfVUtgTfYUwE/dX5A5cK09UKmZm7OCcL7VzfmHQ9MzhHotkK v+8zxSN9k+fTUKpQ3llKpcw7j5huJo/GptRJ4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784798763; x=1785403563; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=C2EtZm5n8do9wevKtSVXp/o4265+P0TBGlYyPhKLrmE=; b=IvpDqfQ6EEhoQ9HDEhMUM1kbuyIuirLjI+MQCpGcf9Bg5Yt9L11/hZZdn8RumdexkE 1bGjFOVvcD1MLWDsoAATLXSyYuT+lCcjfTXNFPXAu0l6Dzzp/1V8PNbxo1msaVhvYryq 8v7nQcthH8QK7g8fQK6CGL5vFTdIbdiqcoR0A6hrGbZBND+crzk3JgXjDVNI5tKXtkjs N+FWZaZ+u/DncPt638Cvv1EAzld7IAHKDGLtW9qpzhns1l0ay1nj8oMCmNCEjHccGQe7 mTvmejV9fSfScojGFKSlqHNTS22xGe3DAgwb4/cw5PUnjj3//oqRH90l/yrbyWjwVVbU cpQw== X-Gm-Message-State: AOJu0YwDtpLl9anktTrpRLptwPY4yeG3rv0DaTax/QRFvq9S4hrWCODc Zw0W1DgzaIoVLN4x85mpNcoQXzf7BAvUCsShjdWdXygHret9nOHM4da+gaTmE6L9tn+bBhj1Xg1 C8iBh/U0= X-Gm-Gg: AR+sD10gNzxZ2YySeTBL3d0HX60Y8tL/SZHcx42p2VRvkGeFI0SuDIF2MSibKMYl49Z HhNHWOQjARC8UG16bZKG/QuNQQ6dVdcUbvmbbpcMlvwsWv5V6lPbG/ZP85zQzsB+V+ktNl9sSQ0 gjQj1Z6TrgBhoZLicyAoQGdDtbLVgUFUp6/+HwcuxzZcYV5QlwyFV8Ssccm6DR97K2K8i97BUK2 bmxbmajR/3ROqCrdLBLoitLorsYep2XWIfxFreIL24gYKRJTk6sDMptzDl0SGfeOGhQWHV2ufA8 IIzg0TQ2N1rt1UjvuXZQyDQ3cATOCg10vsxB7LN66EcLVKRa+LrghbjcPxVCedHn70KWmAcD2aO Txl+y8dcIsE1SFPmpVnIDWkNyhlBp7XhyvIuOxrkscTQqRiCVoL1FTVC7OEeP1YEGwazCbZ7jmu kgF35koioJTFk= X-Received: by 2002:a17:903:3806:b0:2cc:77f3:a927 with SMTP id d9443c01a7336-2cfa6c5df36mr26149315ad.26.1784798762717; Thu, 23 Jul 2026 02:26:02 -0700 (PDT) Received: from MVIN00030.mvista.com ([157.32.44.18]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147e1c7ff4sm19333788eec.27.2026.07.23.02.26.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 02:26:02 -0700 (PDT) From: Siddharth To: openembedded-core@lists.openembedded.org Cc: Siddharth Doshi Subject: [OE-core][scarthgap][PATCHv2 01/13] vim: Security Fix for CVE-2026-28422 Date: Thu, 23 Jul 2026 14:53:42 +0530 Message-Id: <20260723092354.54697-1-sdoshi@mvista.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 23 Jul 2026 09:26:07 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241805 From: Siddharth Doshi Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-28422 [2] https://security-tracker.debian.org/tracker/CVE-2026-28422 Signed-off-by: Siddharth Doshi --- .../vim/files/CVE-2026-28422.patch | 44 +++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 45 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-28422.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-28422.patch b/meta/recipes-support/vim/files/CVE-2026-28422.patch new file mode 100644 index 0000000000..89f219ccf6 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-28422.patch @@ -0,0 +1,44 @@ +From fcf19885004325f5a52db6bd6893cb5b387799d3 Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Tue, 24 Feb 2026 20:29:20 +0000 +Subject: [PATCH 01/17] patch 9.2.0078: [security]: stack-buffer-overflow in + build_stl_str_hl() + +Problem: A stack-buffer-overflow occurs when rendering a statusline + with a multi-byte fill character on a very wide terminal. + The size check in build_stl_str_hl() uses the cell width + rather than the byte length, allowing the subsequent fill + loop to write beyond the 4096-byte MAXPATHL buffer + (ehdgks0627, un3xploitable). +Solution: Update the size check to account for the byte length of + the fill character (using MB_CHAR2LEN). + +Github Advisory: +https://github.com/vim/vim/security/advisories/GHSA-gmqx-prf2-8mwf + +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/4e5b9e31cb7484ad156fba995fdce3c9b075b5fd] +CVE: CVE-2026-28422 +Signed-off-by: Siddharth Doshi +--- + src/buffer.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/buffer.c b/src/buffer.c +index 0feafc590d..363dd0e04a 100644 +--- a/src/buffer.c ++++ b/src/buffer.c +@@ -5293,7 +5293,8 @@ build_stl_str_hl( + } + width = maxwidth; + } +- else if (width < maxwidth && outputlen + maxwidth - width + 1 < outlen) ++ else if (width < maxwidth && ++ outputlen + (maxwidth - width) * MB_CHAR2LEN(fillchar) + 1 < outlen) + { + // Find how many separators there are, which we will use when + // figuring out how many groups there are. +-- +2.44.4 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index d69a337b4e..485eedb061 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -36,6 +36,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \ file://CVE-2026-52858.patch \ file://CVE-2026-52859.patch \ file://CVE-2026-52860.patch \ + file://CVE-2026-28422.patch \ " PV .= ".1683" From patchwork Thu Jul 23 09:23:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Siddharth X-Patchwork-Id: 93330 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 26C1BC531CB for ; Thu, 23 Jul 2026 09:26:07 +0000 (UTC) Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.19526.1784798766083113223 for ; Thu, 23 Jul 2026 02:26:06 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@mvista.com header.s=google header.b=M/EkuQMI; spf=pass (domain: mvista.com, ip: 209.85.215.170, mailfrom: sdoshi@mvista.com) Received: by mail-pg1-f170.google.com with SMTP id 41be03b00d2f7-c9c26a5fb98so169371a12.0 for ; Thu, 23 Jul 2026 02:26:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mvista.com; s=google; t=1784798765; x=1785403565; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=0u/yVdG4DJPtUs7GRkeutaKl+06hoQAlOyYNbLlDADk=; b=M/EkuQMIruamYW/D3aqNzN8zFlSamI6J6K0TIorwLdKsjEsEvepU1bEveZmTeiN6jj uKqx+I7SpvtBxFaGx5DBhH7isuxCWnZ7Okq5cdk6Zy5C+4Hptvt9hgtrCEbtSyd/og8u AktyuaeCQ6lvZDClj7PddLFwrgdM/C7YzCHYY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784798765; x=1785403565; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=0u/yVdG4DJPtUs7GRkeutaKl+06hoQAlOyYNbLlDADk=; b=aMUpVm17wwElAtP39rN+oxQTSD8Zx2JPq/zza9dplAsP68cpIrgmHz11mT7euy2CTs l5XY9TwJJRlExfsH+iAT13l3eajpD8aTFEMd6eerJiN+KO9iyfjKgL1UmOBHclIHmM44 4QaP76hThde7RpjO8Y7uybqEi6cKrhu3D8vcC8aKige5xLKnwDq3nKv3jrMMPiD8PYSx VK8Ot2/m+ax+tQvnewDINOVu7q6DuxrpIj+2CKHNj+c7whniP+bHTd1s/V0QrvXx5e8l vms2icDiYbqsl9aD6QLfkJIn3Qog3NgFT2FudpTiIepoFceoYHoZ+mk2rRNGmLkLh+LS DXaQ== X-Gm-Message-State: AOJu0YxWLMxlJ9yyVaJEGwEvPcLSbWAVRuDvqths1U6xHs53WL+AIRL9 0fQnVUwdNkCy79I2p1UF+iXktxMeDZolMk7PI2CA5hvQOyjBCsdOe0Vcy60nn/U/X57IccBaFFB m89XzZJM= X-Gm-Gg: AR+sD10rmb23pKHrEKu97eC7NHP1liHXlsIefszFiPAvyOZQMsLcrOKC8ASPuykEIrk 3vlSMTP1jk2x70UDLwKe/d3l5ifPBa3/zlCaGXmprZQuvBF47Nvy5qJPC079+nQNpEaMCAKKYPW EeFkWL4m7NVNJ3YNjarWqqYkfMaE6XHapLRMbno7jw0l1Cwk18gu+sdHVjUErmpiDn+wFSvzMtQ 4WK00m2fUj9sAy3ETjQWeBMr4KeNQCW48Jqx6h/kfMN0NkG4OBruRWc3v+CmkLQLZmhGMl6JLoQ fBEnHTsxmIOIpbMx9TD7QkSXo9lsAgZyzQlCCruUrbmrLq9OeTJN2ZKO+CeIXt7otSCT8ZdCezD EaqfsiIgBxLS+za7q8HiFZ6FbOLKvzeRsaZOPxwUAdLbt1ZqCdA5AQ2FuE6tWGdKF0/+N7gN65B yERGSZA4VpcwA= X-Received: by 2002:a05:6a21:4cc3:b0:3bf:9bd9:cf60 with SMTP id adf61e73a8af0-3c44c95a55dmr2225833637.6.1784798765405; Thu, 23 Jul 2026 02:26:05 -0700 (PDT) Received: from MVIN00030.mvista.com ([157.32.44.18]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147e1c7ff4sm19333788eec.27.2026.07.23.02.26.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 02:26:04 -0700 (PDT) From: Siddharth To: openembedded-core@lists.openembedded.org Cc: Siddharth Doshi Subject: [OE-core][scarthgap][PATCHv2 02/13] vim: Security Fix for CVE-2026-42307 Date: Thu, 23 Jul 2026 14:53:43 +0530 Message-Id: <20260723092354.54697-2-sdoshi@mvista.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260723092354.54697-1-sdoshi@mvista.com> References: <20260723092354.54697-1-sdoshi@mvista.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 23 Jul 2026 09:26:07 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241806 From: Siddharth Doshi Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-42307 [2] https://security-tracker.debian.org/tracker/CVE-2026-42307 Signed-off-by: Siddharth Doshi --- .../vim/files/CVE-2026-42307.patch | 121 ++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 122 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-42307.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-42307.patch b/meta/recipes-support/vim/files/CVE-2026-42307.patch new file mode 100644 index 0000000000..03acd436a0 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-42307.patch @@ -0,0 +1,121 @@ +From 936634660e3836e1a495965b48a0dc913e9d0deb Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Tue, 21 Apr 2026 19:03:02 +0000 +Subject: [PATCH 02/17] patch 9.2.0383: [security]: runtime(netrw): + shell-injection via sftp: and file: URLs + +Problem: runtime(netrw): shell-injection via sftp: and file: URLs + (Joshua Rogers) +Solution: Escape temporary file names, harden filename suffix regex, + drop unused g:netrw_tmpfile_escape variable + +Supported by AI + +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/405e2fb6d54d5653523809e2853d99d1c000a5fc] +CVE: CVE-2026-42307 +Signed-off-by: Siddharth Doshi +--- + runtime/doc/pi_netrw.txt | 4 ---- + runtime/doc/tags | 1 - + runtime/pack/dist/opt/netrw/autoload/netrw.vim | 16 +++++++++------- + runtime/pack/dist/opt/netrw/doc/netrw.txt | 4 ---- + 4 files changed, 9 insertions(+), 16 deletions(-) + +diff --git a/runtime/doc/pi_netrw.txt b/runtime/doc/pi_netrw.txt +index a86cac36ba..2d98a8407b 100644 +--- a/runtime/doc/pi_netrw.txt ++++ b/runtime/doc/pi_netrw.txt +@@ -2854,10 +2854,6 @@ your browsing preferences. (see also: |netrw-settings|) + such as listing, file removal, etc. + default: ssh + +- *g:netrw_tmpfile_escape* =' &;' +- escape() is applied to all temporary files +- to escape these characters. +- + *g:netrw_timefmt* specify format string to vim's strftime(). + The default, "%c", is "the preferred date + and time representation for the current +diff --git a/runtime/doc/tags b/runtime/doc/tags +index 300dfd18a6..7ce3b63075 100644 +--- a/runtime/doc/tags ++++ b/runtime/doc/tags +@@ -7863,7 +7863,6 @@ g:netrw_ssh_browse_reject pi_netrw.txt /*g:netrw_ssh_browse_reject* + g:netrw_ssh_cmd pi_netrw.txt /*g:netrw_ssh_cmd* + g:netrw_sshport pi_netrw.txt /*g:netrw_sshport* + g:netrw_timefmt pi_netrw.txt /*g:netrw_timefmt* +-g:netrw_tmpfile_escape pi_netrw.txt /*g:netrw_tmpfile_escape* + g:netrw_uid pi_netrw.txt /*g:netrw_uid* + g:netrw_use_noswf pi_netrw.txt /*g:netrw_use_noswf* + g:netrw_use_nt_rcp pi_netrw.txt /*g:netrw_use_nt_rcp* +diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +index 1c98104d00..805474616d 100644 +--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim ++++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +@@ -378,7 +378,6 @@ else + call s:NetrwInit("g:netrw_glob_escape",'*[]?`{~$\') + endif + call s:NetrwInit("g:netrw_menu_escape",'.&? \') +-call s:NetrwInit("g:netrw_tmpfile_escape",' &;') + call s:NetrwInit("s:netrw_map_escape","<|\n\r\\\\"") + if has("gui_running") && (&enc == 'utf-8' || &enc == 'utf-16' || &enc == 'ucs-4') + let s:treedepthstring= "│ " +@@ -1799,14 +1798,14 @@ function netrw#NetRead(mode,...) + "......................................... + " NetRead: (sftp) NetRead Method #9 {{{3 + elseif b:netrw_method == 9 +- call netrw#os#Execute(s:netrw_silentxfer."!".g:netrw_sftp_cmd." ".netrw#os#Escape(g:netrw_machine.":".b:netrw_fname,1)." ".tmpfile) ++ call netrw#os#Execute(s:netrw_silentxfer."!".g:netrw_sftp_cmd." ".netrw#os#Escape(g:netrw_machine.":".b:netrw_fname,1)." ".netrw#os#Escape(tmpfile,1)) + let result = s:NetrwGetFile(readcmd, tmpfile, b:netrw_method) + let b:netrw_lastfile = choice + + "......................................... + " NetRead: (file) NetRead Method #10 {{{3 + elseif b:netrw_method == 10 && exists("g:netrw_file_cmd") +- call netrw#os#Execute(s:netrw_silentxfer."!".g:netrw_file_cmd." ".netrw#os#Escape(b:netrw_fname,1)." ".tmpfile) ++ call netrw#os#Execute(s:netrw_silentxfer."!".g:netrw_file_cmd." ".netrw#os#Escape(b:netrw_fname,1)." ".netrw#os#Escape(tmpfile,1)) + let result = s:NetrwGetFile(readcmd, tmpfile, b:netrw_method) + let b:netrw_lastfile = choice + +@@ -8927,14 +8926,17 @@ function s:GetTempfile(fname) + endif + + " use fname's suffix for the temporary file ++ " Restrict the suffix to word characters so shell metacharacters in a ++ " remote filename (e.g. sftp://host/foo.txt;id) cannot ride along into ++ " the tempfile name and out into a downstream shell command. + if a:fname != "" +- if a:fname =~ '\.[^./]\+$' ++ if a:fname =~ '\.\w\+$' + if a:fname =~ '\.tar\.gz$' || a:fname =~ '\.tar\.bz2$' || a:fname =~ '\.tar\.xz$' +- let suffix = ".tar".substitute(a:fname,'^.*\(\.[^./]\+\)$','\1','e') ++ let suffix = ".tar".substitute(a:fname,'^.*\(\.\w\+\)$','\1','e') + elseif a:fname =~ '.txz$' +- let suffix = ".txz".substitute(a:fname,'^.*\(\.[^./]\+\)$','\1','e') ++ let suffix = ".txz".substitute(a:fname,'^.*\(\.\w\+\)$','\1','e') + else +- let suffix = substitute(a:fname,'^.*\(\.[^./]\+\)$','\1','e') ++ let suffix = substitute(a:fname,'^.*\(\.\w\+\)$','\1','e') + endif + let tmpfile= substitute(tmpfile,'\.tmp$','','e') + let tmpfile .= suffix +diff --git a/runtime/pack/dist/opt/netrw/doc/netrw.txt b/runtime/pack/dist/opt/netrw/doc/netrw.txt +index 01a5bda597..144bab5fb3 100644 +--- a/runtime/pack/dist/opt/netrw/doc/netrw.txt ++++ b/runtime/pack/dist/opt/netrw/doc/netrw.txt +@@ -2854,10 +2854,6 @@ your browsing preferences. (see also: |netrw-settings|) + such as listing, file removal, etc. + default: ssh + +- *g:netrw_tmpfile_escape* =' &;' +- escape() is applied to all temporary files +- to escape these characters. +- + *g:netrw_timefmt* specify format string to vim's strftime(). + The default, "%c", is "the preferred date + and time representation for the current +-- +2.44.4 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 485eedb061..7a865f122e 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -37,6 +37,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \ file://CVE-2026-52859.patch \ file://CVE-2026-52860.patch \ file://CVE-2026-28422.patch \ + file://CVE-2026-42307.patch \ " PV .= ".1683" From patchwork Thu Jul 23 09:23:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Siddharth X-Patchwork-Id: 93334 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6D3F6C531CF for ; Thu, 23 Jul 2026 09:26:17 +0000 (UTC) Received: from mail-pf1-f171.google.com (mail-pf1-f171.google.com [209.85.210.171]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.19544.1784798769297626049 for ; Thu, 23 Jul 2026 02:26:09 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@mvista.com header.s=google header.b=BVFdZQiv; spf=pass (domain: mvista.com, ip: 209.85.210.171, mailfrom: sdoshi@mvista.com) Received: by mail-pf1-f171.google.com with SMTP id d2e1a72fcca58-845c92bc464so269154b3a.2 for ; Thu, 23 Jul 2026 02:26:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mvista.com; s=google; t=1784798769; x=1785403569; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=kAb9aRdCKQFu+ZnVFV8GJCshqOQBr0afQE8glTI37Kg=; b=BVFdZQivyuXsq8adCHTmhH9amOJj39GOVasPUiP4BRcTtAp3ARS0C99WCBpTbEQobm z9WUAwLMyZadLPGudwHtct/5F9P3+58Xnq1mqqiZNj+4apmNBouE7YJ4OoiTuN4YY94T kOR9HqC0Ch6V/JB6G+BDjTsUkTCJcDdRVmjnM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784798769; x=1785403569; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=kAb9aRdCKQFu+ZnVFV8GJCshqOQBr0afQE8glTI37Kg=; b=mguAQKrOx0aHec2Oc38NWQZK88W6WFZhCzFru+0ph+hOKOR+L6COeQdbSb89lFv3QK X5B2Rxu4IqIYGe1m5ELhpwxd3lem10g7gK3RoQX8jxjddQ9lOqOSZitZUuQ5seuUCRKn BLE3Y3bwxXbuD2EsHp16x2Nkv08OpeVCF0I1snr7nl8SKMvpt41s/OLXCxGiK4BHEc0O suLjADKKl1LTexoTnRrzaKvnwzeX8tLrudfaUH585EMWEKfuYHB5L/Ta/W5Wrq5/30TB hq5l9mDb4Jie8mq/xE9FybuRUnGHxa7HOxm6T0x38Ij4oT8gFd5Lo1hWwnHk6rSXHIDR mfRw== X-Gm-Message-State: AOJu0YzVXNnBZQKsFgMZjcM0qq5BMH9Pq5TxN16RU8zCK8hj/XHH3tbS zPsjTqeBYBOrLsPcxe/HW7aVuqizP0sOsTsak0wgDGx5kmf4fvq7wLP2/73ItHprzsIcfxuNfhh eHvs5Y/4= X-Gm-Gg: AR+sD13xFa8Twe6oBKEWRsqlwzg2RkDpG0VvyV1tpTzWu8awFBdhBTK9KJt94o+E5r3 0uLzw1rsrc1ScGlEaCP3xJEY7ezQcpXNa9+bunMGNRZIVDgR+tXboFUj5IxEqiwx3rxfhgo24ak Fk4bcJxTyiYy0PWbHDh1MiXHOddG5gep90uaNN3QWdpbECqmIYPup7lisjQ6Pwm2BDBzdR6vn90 Q2953Xt4FiqwZJhh3dRT1Rhbi7T2H3tG5oJDD3thhvEcucI5ZNWoKfzEqZTskopcmG82NESQYw4 AwtyAwd5oNWD0m258yhAInVuCq4j5MsEgTsZNkxOGbRpfBj4VNQjxj4r3ftNAMe/yGVDpVMcXWk ghrmZhhX4C/3DV97K30dWmYctFrQwkpljm1UOCXvC0u6inv9kHWCtXk5MMa2pc/E3any8l8kuxN 7y8lJQBtnQfNmK8n8p8mb5kQ== X-Received: by 2002:a05:6a20:c79a:b0:3bf:a698:ce4d with SMTP id adf61e73a8af0-3c44b244083mr2354062637.54.1784798768575; Thu, 23 Jul 2026 02:26:08 -0700 (PDT) Received: from MVIN00030.mvista.com ([157.32.44.18]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147e1c7ff4sm19333788eec.27.2026.07.23.02.26.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 02:26:07 -0700 (PDT) From: Siddharth To: openembedded-core@lists.openembedded.org Cc: Siddharth Doshi Subject: [OE-core][scarthgap][PATCHv2 03/13] vim: Security Fix for CVE-2026-43961 Date: Thu, 23 Jul 2026 14:53:44 +0530 Message-Id: <20260723092354.54697-3-sdoshi@mvista.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260723092354.54697-1-sdoshi@mvista.com> References: <20260723092354.54697-1-sdoshi@mvista.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 23 Jul 2026 09:26:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241807 From: Siddharth Doshi Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://github.com/vim/vim/commit/8af0f098c3a42a28661d0295364e [2] https://security-tracker.debian.org/tracker/CVE-2026-43961 Signed-off-by: Siddharth Doshi --- .../vim/files/CVE-2026-43961.patch | 65 +++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 66 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-43961.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-43961.patch b/meta/recipes-support/vim/files/CVE-2026-43961.patch new file mode 100644 index 0000000000..f9e0fc0df4 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-43961.patch @@ -0,0 +1,65 @@ +From f38c7cb2fcc9d5839386ea4722463ea921f0bbce Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Thu, 14 May 2026 16:43:15 +0000 +Subject: [PATCH 03/17] patch 9.2.0480: [security]: runtime(netrw): code + injection via mf command + +Problem: [security]: runtime(netrw): code injection via mf command + (Christopher Lusk, Zdenek Dohnal) +Solution: Do not use string concatenation inside the filter() commands + (Zdenek Dohnal) + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-66hr-7p6x-x5j3 + +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/8af0f098c3a42a28661d0295364e] +CVE: CVE-2026-43961 +Signed-off-by: Siddharth Doshi +--- + runtime/pack/dist/opt/netrw/autoload/netrw.vim | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +index 805474616d..e484de5c93 100644 +--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim ++++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +@@ -5155,7 +5155,7 @@ function s:NetrwMarkFile(islocal,fname) + + else + " remove filename from buffer's markfilelist +- call filter(s:netrwmarkfilelist_{curbufnr},'v:val != a:fname') ++ call filter(s:netrwmarkfilelist_{curbufnr}, {_, v -> v !=# a:fname}) + if s:netrwmarkfilelist_{curbufnr} == [] + " local markfilelist is empty; remove it entirely + call s:NetrwUnmarkList(curbufnr,curdir) +@@ -5176,7 +5176,6 @@ function s:NetrwMarkFile(islocal,fname) + + else + " initialize new markfilelist +- + let s:netrwmarkfilelist_{curbufnr}= [] + call add(s:netrwmarkfilelist_{curbufnr},substitute(a:fname,'[|@]$','','')) + +@@ -5196,7 +5195,7 @@ function s:NetrwMarkFile(islocal,fname) + call add(s:netrwmarkfilelist,netrw#fs#ComposePath(b:netrw_curdir,a:fname)) + else + " remove new filename from global markfilelist +- call filter(s:netrwmarkfilelist,'v:val != "'.dname.'"') ++ call filter(s:netrwmarkfilelist, {_, v -> v !=# dname}) + if s:netrwmarkfilelist == [] + unlet s:netrwmarkfilelist + endif +@@ -7202,7 +7201,7 @@ function s:NetrwTreeDisplay(dir,depth) + " hide given patterns + let listhide= split(g:netrw_list_hide,',') + for pat in listhide +- call filter(w:netrw_treedict[dir],'v:val !~ "'.escape(pat,'\\').'"') ++ call filter(w:netrw_treedict[dir], {_, v -> v !~# pat}) + endfor + + elseif g:netrw_hide == 2 +-- +2.44.4 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 7a865f122e..2175c5f9a8 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -38,6 +38,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \ file://CVE-2026-52860.patch \ file://CVE-2026-28422.patch \ file://CVE-2026-42307.patch \ + file://CVE-2026-43961.patch \ " PV .= ".1683" From patchwork Thu Jul 23 09:23:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Siddharth X-Patchwork-Id: 93332 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 64AC6C531C7 for ; Thu, 23 Jul 2026 09:26:17 +0000 (UTC) Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.19545.1784798772170353856 for ; Thu, 23 Jul 2026 02:26:12 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@mvista.com header.s=google header.b=Ih7Pk8jX; spf=pass (domain: mvista.com, ip: 209.85.214.181, mailfrom: sdoshi@mvista.com) Received: by mail-pl1-f181.google.com with SMTP id d9443c01a7336-2cf52d15d88so4278075ad.2 for ; Thu, 23 Jul 2026 02:26:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mvista.com; s=google; t=1784798771; x=1785403571; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=C2wqpPQjn9/7VR4RuOnbDZMeCjm8VCQnwMblmJ4BHkk=; b=Ih7Pk8jXPG4PU4OSizLx4cfJ13rFyx0B/4GY23ige5TOhb6oNjKTI8IZvwvRiHNnsE HlremurdCXj1K8tePKPwbLxq6xFWTWhFUgJSrcIjsAHQuLZWZ/JkjzR+sSsYTjFjb8TO jjHIqml34YX4MnMzvNz3WqYOqMK+YgA8ons9U= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784798771; x=1785403571; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=C2wqpPQjn9/7VR4RuOnbDZMeCjm8VCQnwMblmJ4BHkk=; b=ch9TLuRDBvLCNSVzYDhDFi7VK7MYLWtDEusWyK4qNLJoGSM+oltH/pmTffI1sAiP9s 9cW7N6z5sQLRV2EBCbLtkjAaeoH3Vy5tTTxIAOIxt2tUzpr33isEF9l59ynNTWhJ6WBG kRwo3sDBjpHjrWbBoNtsmiSThOpr/6cUodROh9eMGCouZUhz/VOFAmNcr9PQCsN4SNqZ oQfEUNvzfJA/66K7/oSOHRccV6xOslYl1FjAD5Oa41AvICal4mLWj2LQQQs2Et8qonBu WVqKoOeSKmzXfQ5UvxbvoIy2ML8esJKaPAaWf1R3+vEO2C4mycbynKTeqLYO1u6gd/TK bITw== X-Gm-Message-State: AOJu0Yz3fi3mIYXWcAw/5ph8NDk7OGu6Z2hUeplBD9Smq9eVr/AEnICW 1P6QLZ9bwaza5/x7joSmo2Q718tyzb0U9+5xQACrpotPPP5f1fsZ4AyLhuIyZr+CE7xJAdouk0P e6+JK7cM= X-Gm-Gg: AR+sD11z+t6QEG4dAwjldJEyuLLg9pCg4jCNhQ7PaQnRB6bxhjBwAP3mJzBse9Hh48A ldNKf7AVg1qyQcEb1VROFMpQYQU2BtFw91gN5wh9OBS/enLGFSsD1sOx+VppJnNoyDU9O8F5ZAr d98MNHWlDFK7E2CWYcl0iju00ye4dvFzCyov0SnHgKybZHlT8gE7JcEk8+et9COyi2WC5426a8e MzctQHrxgDYJTSppjbEckEXh8ntbEIambYEq05eXYgAp+gnq3Mg6TPlYJkIEGKZAG+ktOZpbZIf F16NGadIvfW06Sy2cfa4+V6xn4ZjonuzwKLfUPVEN91Kv2xmHQHVVbvpxQksUWHykEIaI1jqLqi ZJdDEUp1bIbvbcwLL0QDDnGx7d01ji8u9wscm3LOx/LaDIb1VE4vk0NnJyUDrFDoUknuSW5V1Ev R66tzCHlrs1ng= X-Received: by 2002:a17:903:9ce:b0:2cf:83bf:6b05 with SMTP id d9443c01a7336-2cfa6f82203mr26830205ad.41.1784798771402; Thu, 23 Jul 2026 02:26:11 -0700 (PDT) Received: from MVIN00030.mvista.com ([157.32.44.18]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147e1c7ff4sm19333788eec.27.2026.07.23.02.26.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 02:26:11 -0700 (PDT) From: Siddharth To: openembedded-core@lists.openembedded.org Cc: Siddharth Doshi Subject: [OE-core][scarthgap][PATCHv2 04/13] vim: Security Fix for CVE-2026-47162 Date: Thu, 23 Jul 2026 14:53:45 +0530 Message-Id: <20260723092354.54697-4-sdoshi@mvista.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260723092354.54697-1-sdoshi@mvista.com> References: <20260723092354.54697-1-sdoshi@mvista.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 23 Jul 2026 09:26:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241808 From: Siddharth Doshi Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-47162 [2] https://security-tracker.debian.org/tracker/CVE-2026-47162 Signed-off-by: Siddharth Doshi --- .../vim/files/CVE-2026-47162.patch | 39 +++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 40 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-47162.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-47162.patch b/meta/recipes-support/vim/files/CVE-2026-47162.patch new file mode 100644 index 0000000000..33f1ebbfd1 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-47162.patch @@ -0,0 +1,39 @@ +From d254c3b584e19555f2aecc4886ae7c92c0acc199 Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Sun, 17 May 2026 18:53:48 +0000 +Subject: [PATCH 04/17] patch 9.2.0495: [security]: runtime(netrw): code + injection via NetrwBookHistSave() + +Problem: [security]: runtime(netrw): code injection via + NetrwBookHistSave() +Solution: Properly quote the directory name using string() function + (Srinivas Piskala Ganesh Babu) + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c + +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b] +CVE: CVE-2026-47162 +Signed-off-by: Siddharth Doshi +--- + runtime/pack/dist/opt/netrw/autoload/netrw.vim | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +index e484de5c93..9014ca339b 100644 +--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim ++++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +@@ -2921,7 +2921,7 @@ function s:NetrwBookHistSave() + while ( first || cnt != g:netrw_dirhistcnt ) + let lastline= lastline + 1 + if exists("g:netrw_dirhist_{cnt}") +- call setline(lastline,'let g:netrw_dirhist_'.cnt."='".g:netrw_dirhist_{cnt}."'") ++ call setline(lastline,'let g:netrw_dirhist_'.cnt.'='.string(g:netrw_dirhist_{cnt})) + endif + let first = 0 + let cnt = ( cnt - 1 ) % g:netrw_dirhistmax +-- +2.44.4 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 2175c5f9a8..3fd0b66bf4 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -39,6 +39,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \ file://CVE-2026-28422.patch \ file://CVE-2026-42307.patch \ file://CVE-2026-43961.patch \ + file://CVE-2026-47162.patch \ " PV .= ".1683" From patchwork Thu Jul 23 09:23:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Siddharth X-Patchwork-Id: 93333 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 50AD5C531CB for ; Thu, 23 Jul 2026 09:26:17 +0000 (UTC) Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.19546.1784798774795153125 for ; Thu, 23 Jul 2026 02:26:14 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@mvista.com header.s=google header.b=WOkwO4Kb; spf=pass (domain: mvista.com, ip: 209.85.216.41, mailfrom: sdoshi@mvista.com) Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-38e041ea211so401354a91.0 for ; Thu, 23 Jul 2026 02:26:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mvista.com; s=google; t=1784798774; x=1785403574; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=qrbF6GTkiHbfTyR0uiHvwBxcb7poKJrnY3oVr37IyF8=; b=WOkwO4KbDZ3/GKMxcC7soN2sgcq1G6aPefZvGHCra2m0iXyMDLnMiDk5RsgXwuWuyI GGBDaE6X2kAXhU3IZEUujbKsn/Em7yJAMX1oPEI2uW9h4QpunS4MnC3ZDwpATLUCf5n9 fscOlySED4dFKIFcVHqJMpkqE8cL0hDbCQLbE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784798774; x=1785403574; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=qrbF6GTkiHbfTyR0uiHvwBxcb7poKJrnY3oVr37IyF8=; b=VVdIFcjNmHnYZoqoqLVgH6PfwYPodn/xYQNqNbq3pFe0sfsxqrRGtspq5hWVwdyPcJ aPlhuEBPy+mMtdsS/tmuE9qvt+lgRVjOGIeEiXzSPSCc0GmlFzvWsjBKR/ckNuFeqK2v EFKIdhuwC0I83NHenoNUpWKt3Pe1AJEOIBfG5YZa695G9d0AD5z3CtzhEI3KXJulULIN Jlrb6ZfkRIZhfN5rdLqo1QKmH2MOHRMjx5AyEXxCRDYeVFBZAtt+LhHNZ5NFb43KJTWM /o8IuhliOfkKa/0tD949wIYdsundvQCKqLD7iBaUzu/DucM8JtUIYH3XPgGk8erXgUK8 v8qw== X-Gm-Message-State: AOJu0Ywrbz3frPr1YM3nV7bfWup70TLYuiEu5fvbdmvBoBCjm1P34YlQ YrOKF0QxI1Q+HPkEhaCFDOBUXWWawR/ggMLZAM8IcCXNpiclMiv//9AbNbrgzG44pLDqziikUM6 ZBpCQNgA= X-Gm-Gg: AR+sD13eYBglmXFU0MZOTfcPcjusyDy0QnDjk+DmZQrOGnAbw9D2QoPkqQuhDe/siKw 4Dp80qlwFh3lB8xEC0mmSnfVkHWd2AGCLxFDHLSrL2oYZq6D4c0V/bfrMdlkeFOrt2Dlnbm+rp5 Jbmhoz3+hm+va5Ti1noz+A4h+V8ZhG1Qxuk8Gvhx9Mi3o0wxUCPR4MeZuGSa21WK7QIhaM36kVI neGwstIS9s0b6fQGwWajHc73p6N1btY3suHUikZS9WAh5z/4bIbxkIaFhQvc2qiXaUt/wI9TG/n uXOFIus7D/4YXwMVShnRofJaOfYcsUvKOdkgmyDgb9CWPC3LOH1ql/OvKulMSqrY+4glp+0Gaep Tj3SuR7rctgTABNyoNN+RaZQ1ebsn8zEPNtMzuC8pfJYtbImUyzT462/kdJW6aVHMTItTMuRVcm rZxABbozDGFvqSzY/rw4ncXA== X-Received: by 2002:a05:6a20:6a1c:b0:3c3:9c4e:de3a with SMTP id adf61e73a8af0-3c44afb705dmr2337641637.6.1784798774199; Thu, 23 Jul 2026 02:26:14 -0700 (PDT) Received: from MVIN00030.mvista.com ([157.32.44.18]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147e1c7ff4sm19333788eec.27.2026.07.23.02.26.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 02:26:13 -0700 (PDT) From: Siddharth To: openembedded-core@lists.openembedded.org Cc: Siddharth Doshi Subject: [OE-core][scarthgap][PATCHv2 05/13] vim: Security Fix for CVE-2026-47167 Date: Thu, 23 Jul 2026 14:53:46 +0530 Message-Id: <20260723092354.54697-5-sdoshi@mvista.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260723092354.54697-1-sdoshi@mvista.com> References: <20260723092354.54697-1-sdoshi@mvista.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 23 Jul 2026 09:26:17 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241809 From: Siddharth Doshi Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-47167 [2] https://security-tracker.debian.org/tracker/CVE-2026-47167 Signed-off-by: Siddharth Doshi --- .../vim/files/CVE-2026-47167.patch | 39 +++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 40 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-47167.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-47167.patch b/meta/recipes-support/vim/files/CVE-2026-47167.patch new file mode 100644 index 0000000000..f0e493290c --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-47167.patch @@ -0,0 +1,39 @@ +From e117fcc6f1c1973602c8e2c6529fba9ee1ce59b4 Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Sun, 17 May 2026 19:39:24 +0000 +Subject: [PATCH 05/17] patch 9.2.0496: [security]: Code Injection in cucumber + filetype plugin + +Problem: [security]: Code Injection in cucumber filetype plugin + (Christopher Lusk) +Solution: Use rubys Regexp.new() with the untrusted pattern + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9 + +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934] +CVE: CVE-2026-47167 +Signed-off-by: Siddharth Doshi +--- + runtime/ftplugin/cucumber.vim | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/runtime/ftplugin/cucumber.vim b/runtime/ftplugin/cucumber.vim +index f4848d1c60..3361f1db4a 100644 +--- a/runtime/ftplugin/cucumber.vim ++++ b/runtime/ftplugin/cucumber.vim +@@ -96,7 +96,8 @@ function! s:stepmatch(receiver,target) + catch + endtry + if has("ruby") && pattern !~ '\\\@ X-Patchwork-Id: 93337 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 87348C531CB for ; Thu, 23 Jul 2026 09:26:27 +0000 (UTC) Received: from mail-pg1-f180.google.com (mail-pg1-f180.google.com [209.85.215.180]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.19529.1784798778963613198 for ; Thu, 23 Jul 2026 02:26:19 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@mvista.com header.s=google header.b=i+vbL05s; spf=pass (domain: mvista.com, ip: 209.85.215.180, mailfrom: sdoshi@mvista.com) Received: by mail-pg1-f180.google.com with SMTP id 41be03b00d2f7-c9c26a5fb98so169506a12.0 for ; Thu, 23 Jul 2026 02:26:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mvista.com; s=google; t=1784798778; x=1785403578; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=WDhuEj5qrFtpVTGBOrlrppIQQpdz81Lb0x1DkjsxYFQ=; b=i+vbL05sslecQb2gDHw5Aky5robpFkPOoFVPt5Dc0oLxJxwG/w2+pluxdW+63lrwlc ES5ydHoZaMsko8h7IRozf1+aAlEAyUNAZWMr8YgCs32Iv5RYd1UpLOgrYWc4TjHufF10 OvO2Iz183NbC8JwUetxAeIUDu4yvcpgXdZ3uc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784798778; x=1785403578; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=WDhuEj5qrFtpVTGBOrlrppIQQpdz81Lb0x1DkjsxYFQ=; b=j1bEk6wYq7CIG85gRhUx2OA+XHSeJOZzyGWYtX49T7QMmE1apAB683SBNjt5TqqbZD K8N4L5KtyFpjotc/dRdxo55nc0duWm7dffPrENO0e6s8bUHCCtn9bCTMUBl/1489aF6u T9BGJH3nvT9tLMQBFKosYDLK+hJoCBKw3xBl0D+4nILCjcRvo02ITJLG+DNUPs7Ot2Mz NqLY94ceVHP2h8+ud4oYy8RsS/D54DN8Ue3VsaXvKr2oN6emPw13wG3YTGg2NOcEKngI 0wz114RXNg2ZZv7H3KyuXfTB//pwNETrcv/QUYnuhMADmCFAOMYnIGU7f/1EBprfaOKY q/2g== X-Gm-Message-State: AOJu0YyEhuuyRYUeHW3HVDEIyd2C5sKQY3WGrhtShCKFURQ8F6vOvsNK O/E6pOk4Seyp6TvConEOD2QGf4FwdxnBIB4irW6nz3k9W6A9bVhNsZyraiI0v+r7w4dC/9X26MQ 7L4L0xpg= X-Gm-Gg: AR+sD1089MbbtIUZBaKVbuPRyBqfNi2PnOkGYFi8aPinPuJKSbOFOB6XbJp2S7W0oHJ G1yE4/7jcRFCu96fmph0+LzHgCNGupiy2RL4G2097DaubTZhPrN6gz/71vhn+V5Txo3a6qPbiih x2TNuG097yDVjJQRQwDYU7barMx5X5J2426e5uHWEzggwYx9C3A46WzB+LTmorH0hYBW2fXA0Gb kS1VAvSz2qrJXnyhIBaPFCupBWyoi02RHnQAd4Iu4JvwF3rKVEsXcBws5ClNpeQF0/Xso7EwG5v TLDIGD7ZQ72ox7GEBwn1Oddo1QrCedC2wQNTw+u+ggtFeM+Cxp/Y+HKu6YCQje6yPXJqzScCBnA 7DDv3+zaDL3VlnVZvCEReiHzCP5o5U5TDXG3EUN8EXHUOGPUU3FbGGdOaohXa+yYNNKJ39n5aRy 3lVw8Y42T8VdI= X-Received: by 2002:a05:6a20:9144:b0:3b4:6af4:bdd5 with SMTP id adf61e73a8af0-3c44c9c5d2cmr2093539637.15.1784798778317; Thu, 23 Jul 2026 02:26:18 -0700 (PDT) Received: from MVIN00030.mvista.com ([157.32.44.18]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147e1c7ff4sm19333788eec.27.2026.07.23.02.26.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 02:26:16 -0700 (PDT) From: Siddharth To: openembedded-core@lists.openembedded.org Cc: Siddharth Doshi Subject: [OE-core][scarthgap][PATCHv2 06/13] vim: Security Fix for CVE-2026-55693 Date: Thu, 23 Jul 2026 14:53:47 +0530 Message-Id: <20260723092354.54697-6-sdoshi@mvista.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260723092354.54697-1-sdoshi@mvista.com> References: <20260723092354.54697-1-sdoshi@mvista.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 23 Jul 2026 09:26:27 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241810 From: Siddharth Doshi Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-55693 [2] https://security-tracker.debian.org/tracker/CVE-2026-55693 Signed-off-by: Siddharth Doshi --- .../vim/files/CVE-2026-55693.patch | 88 +++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 89 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-55693.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-55693.patch b/meta/recipes-support/vim/files/CVE-2026-55693.patch new file mode 100644 index 0000000000..d35b6f5fe5 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-55693.patch @@ -0,0 +1,88 @@ +From 315b35adb406138c962bcc653db95acc3c87c8ab Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Mon, 15 Jun 2026 19:39:08 +0000 +Subject: [PATCH 09/17] patch 9.2.0653: [security]: out-of-bounds write in + tree_count_words() + +Problem: [security]: a crafted spell file can drive tree_count_words() + past the end of its MAXWLEN-sized depth arrays; the descent + loop has no depth bound. +Solution: only descend while depth < MAXWLEN - 1, as the sibling trie + walkers already do; apply the same guard to sug_filltree(). + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq + +Supported by AI. + +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7] +CVE: CVE-2026-55693 +Signed-off-by: Siddharth Doshi +--- + src/spellfile.c | 4 ++-- + src/testdir/test_spellfile.vim | 27 +++++++++++++++++++++++++++ + 2 files changed, 29 insertions(+), 2 deletions(-) + +diff --git a/src/spellfile.c b/src/spellfile.c +index 0b9536dc16..0010d9aa27 100644 +--- a/src/spellfile.c ++++ b/src/spellfile.c +@@ -645,7 +645,7 @@ tree_count_words(char_u *byts, idx_T *idxs) + ++curi[depth]; + } + } +- else ++ else if (depth < MAXWLEN - 1) + { + // Normal char, go one level deeper to count the words. + ++depth; +@@ -5648,7 +5648,7 @@ sug_filltree(spellinfo_T *spin, slang_T *slang) + ++curi[depth]; + } + } +- else ++ else if (depth < MAXWLEN - 1) + { + // Normal char, go one level deeper. + tword[depth++] = c; +diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim +index b72974ed07..e5f8c5778f 100644 +--- a/src/testdir/test_spellfile.vim ++++ b/src/testdir/test_spellfile.vim +@@ -1166,4 +1166,31 @@ func Test_mkspell_empty_dic() + endfunc + + ++func Test_spell_sug_tree_count_words_overflow() ++ " A crafted .spl/.sug pair with a BY_INDEX self-cycle in the fold word tree ++ " parses cleanly (shared refs aren't recursed, so read_tree_node()'s depth ++ " cap never trips), but drove tree_count_words() past its MAXWLEN-sized depth ++ " arrays -> stack out-of-bounds write. The walk only happens when ++ " spellsuggest() loads the matching .sug. Reaching the assert == no OOB. ++ call mkdir('Xrtp/spell', 'pR') ++ " VIMspell + v50, SN_SUGFILE(ts), SN_END, LWORDTREE{node:1,BY_INDEX->0,'A'}, ++ " empty KWORDTREE/PREFIXTREE ++ let spl = eval('0z56494D7370656C6C320B0000000008000000001234' ++ \ .. '5678FF000000020101000000410000000000000000') ++ " VIMsug + v1, matching ts, SUGWORDTREE word "a", empty SUGTABLE ++ let sug = 0z56494D737567010000000012345678000000040161010000000000 ++ call writefile(spl, 'Xrtp/spell/xx.utf-8.spl', 'b') ++ call writefile(sug, 'Xrtp/spell/xx.utf-8.sug', 'b') ++ ++ new ++ set runtimepath+=./Xrtp ++ set spelllang=xx ++ set spell ++ " Unpatched: OOB write here (ASan abort, or crash). Patched: returns a list. ++ call assert_equal(v:t_list, type(spellsuggest('helloo'))) ++ ++ set spell& spelllang& runtimepath& ++ bwipe! ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +-- +2.44.4 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index ec2cedc965..248160a82c 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -41,6 +41,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \ file://CVE-2026-43961.patch \ file://CVE-2026-47162.patch \ file://CVE-2026-47167.patch \ + file://CVE-2026-55693.patch \ " PV .= ".1683" From patchwork Thu Jul 23 09:23:48 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Siddharth X-Patchwork-Id: 93336 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7F020C531CD for ; Thu, 23 Jul 2026 09:26:27 +0000 (UTC) Received: from mail-pg1-f177.google.com (mail-pg1-f177.google.com [209.85.215.177]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.19549.1784798782201134511 for ; Thu, 23 Jul 2026 02:26:22 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@mvista.com header.s=google header.b=WybT4ISV; spf=pass (domain: mvista.com, ip: 209.85.215.177, mailfrom: sdoshi@mvista.com) Received: by mail-pg1-f177.google.com with SMTP id 41be03b00d2f7-c96b08cdd1cso379386a12.0 for ; Thu, 23 Jul 2026 02:26:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mvista.com; s=google; t=1784798781; x=1785403581; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=A+VS8a6uij8vGfeHigtSgyQGgFx7nh/n24Xw8JeMFXk=; b=WybT4ISV8igwYFbRMkgaMejZwyBBFigKqwmcTjTgyQoMX5P+jli1CC3DSan1aF4chi Rb+agzPpwp+gh1xFmez3ovZCUb60o6H/KW2+EFMKXSy9tSp1Ndch0hRDhxySci4XmhZz Vd4acXe5k+fCzSN0xOv8gl5s/p5EGycQwYr3Y= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784798781; x=1785403581; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=A+VS8a6uij8vGfeHigtSgyQGgFx7nh/n24Xw8JeMFXk=; b=LkaPWsGdiY8+MuImi4MiiQGRllQH9kPcIVlDTZy6rOSf2Tl1Ba6KiBj7H6SboUGNbw LEjK8gXBAHAPOkLMf1YANd29ZCHoVAT/qd23ItsqCqAeYfISwAI7bIyIEYZQ+KweBkDp Z1q2LAQm9iGMjCUMUUeGpvZG9gajBZYk8i+ZfMz3bQO5gf0lZklcoCcdCfHGSGkuEoLb 0gEFO42eLfgUNCi068VztHHOLOSSquSK5U+OblUvjtw3QzhWYKw0Hdy8Vbv6tFSEifN6 3xYJTH/XdwPlOaC3v8uN+frF3oUrv/+WIXzTWuYyqC/dPUb6bUFeWyM0km30PEObpSTg 3m8g== X-Gm-Message-State: AOJu0Yw3X0+fh+kQ9SDGwuUwWxgmA1KFqyxNjuUO/Ad5CWD4s2jIr4Vt xuQlj97k08vKv7gPZklffs3MfxfOmIBHHrMwFMHMiaFbzscC0/9XcWX6CLWXMOfJiZSRBA/WRai wGwcATzc= X-Gm-Gg: AR+sD12ihlenfCnHcnJvoVy7ljBRBf5q5b8nhvKK8QOoMalC+Rw1PiInKz0gKiSZsl1 LT0Tx4fNWFo79aspRGIURcj/rgB4+Q9GgSYmUFp6+ksDAQfNqjHAXKfoaJI0B7zxpIbUB3rDOVI EzuyS3+NtasjHAGlRZ9czGOp+9JlXInT7e2K26C9aYbJjleJp8GUQhrSgRE8mvF09eLkFW/etLo 9qzvfhg49qFP5mNPWGNP/5xnnVp7DpdGAXdlpHaEJ2a+C14c/30YxDp1xryE+DBkoPaEQ4ohSjS pFt4p7xv9k8uCeujLDfwaA9o4GyNzms32m4LcS1oVrEsnnb2Xw7UccFkeRDdV6H0C+cSAGgJSNb fL8qLDsPZEucHXv5yKugZD26nF3BVrrsAp+1CrFKAHpDIP/NY0YNLC946QsFKbkr7xGnnsM6oo5 tQhL3utnS5kyI= X-Received: by 2002:a05:6a21:1392:b0:3c3:88a5:83db with SMTP id adf61e73a8af0-3c44afa75f7mr2476747637.5.1784798781495; Thu, 23 Jul 2026 02:26:21 -0700 (PDT) Received: from MVIN00030.mvista.com ([157.32.44.18]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147e1c7ff4sm19333788eec.27.2026.07.23.02.26.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 02:26:20 -0700 (PDT) From: Siddharth To: openembedded-core@lists.openembedded.org Cc: Siddharth Doshi Subject: [OE-core][scarthgap][PATCHv2 07/13] vim: Security Fix for CVE-2026-55892 Date: Thu, 23 Jul 2026 14:53:48 +0530 Message-Id: <20260723092354.54697-7-sdoshi@mvista.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260723092354.54697-1-sdoshi@mvista.com> References: <20260723092354.54697-1-sdoshi@mvista.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 23 Jul 2026 09:26:27 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241811 From: Siddharth Doshi Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-55892 [2] https://security-tracker.debian.org/tracker/CVE-2026-55892 Signed-off-by: Siddharth Doshi --- .../vim/files/CVE-2026-55892.patch | 81 +++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 82 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-55892.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-55892.patch b/meta/recipes-support/vim/files/CVE-2026-55892.patch new file mode 100644 index 0000000000..5f46c97cfa --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-55892.patch @@ -0,0 +1,81 @@ +From f0df4a48a426bd67c0c2f5ad536000a4368cd4c0 Mon Sep 17 00:00:00 2001 +From: Yasuhiro Matsumoto +Date: Tue, 16 Jun 2026 20:32:21 +0000 +Subject: [PATCH 10/17] patch 9.2.0662: [security] Stack out-of-bounds write in + dump_prefixes() + +Problem: [security]: a crafted spell file with a self-referential + BY_INDEX node in the prefix tree can drive dump_prefixes() + past the end of its MAXWLEN-sized depth arrays on :spelldump + (cipher-creator) +Solution: only descend while depth < MAXWLEN - 1, as the sibling trie + walkers already do (Yasuhiro Matsumoto) + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-qm9w-fmpj-879h + +Supported by AI + +Signed-off-by: Yasuhiro Matsumoto +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/8325b193bba5f01e7a7d8241fc8633d93dff996b] +CVE: CVE-2026-55892 +Signed-off-by: Siddharth Doshi +--- + src/spell.c | 2 +- + src/testdir/test_spell.vim | 27 +++++++++++++++++++++++++++ + 2 files changed, 28 insertions(+), 1 deletion(-) + +diff --git a/src/spell.c b/src/spell.c +index 2281986435..6ef3fa899b 100644 +--- a/src/spell.c ++++ b/src/spell.c +@@ -4328,7 +4328,7 @@ dump_prefixes( + } + } + } +- else ++ else if (depth < MAXWLEN - 1) + { + // Normal char, go one level deeper. + prefix[depth++] = c; +diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim +index 170ea57926..2a3f0e3696 100644 +--- a/src/testdir/test_spell.vim ++++ b/src/testdir/test_spell.vim +@@ -1567,4 +1567,31 @@ let g:test_data_aff_sal = [ + \"SAL Z S", + \ ] + ++" A crafted .spl with a self-referential BY_INDEX node in the PREFIXTREE drove ++" dump_prefixes() past its MAXWLEN-sized depth arrays (stack out-of-bounds ++" write). The tree parses cleanly (shared refs aren't recursed); the walk ++" happens on :spelldump. Reaching the assert means no OOB. Same class as the ++" tree_count_words() fix (9.2.0653). ++func Test_spelldump_prefixtree_overflow() ++ CheckUnix ++ call mkdir('Xrtp/spell', 'pR') ++ " VIMspell + v50, SN_PREFCOND(prefixcnt=1), SN_END, ++ " LWORDTREE word "a" with affixID=1 (so dump_prefixes runs), ++ " empty KWORDTREE, PREFIXTREE child BY_INDEX -> nodeidx 0 (self-cycle), 'A' ++ let spl = eval('0z56494D7370656C6C32030000000003000100FF00000004' ++ \ .. '0161010220010000000000000002010100000041') ++ call writefile(spl, 'Xrtp/spell/xx.utf-8.spl', 'b') ++ ++ new ++ set runtimepath+=./Xrtp ++ set spelllang=xx ++ set spell ++ spelldump ++ call assert_true(line('$') > 1) ++ ++ set spell& spelllang& runtimepath& ++ bwipe! ++ bwipe! ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +-- +2.44.4 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 248160a82c..07f7b7dd16 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -42,6 +42,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \ file://CVE-2026-47162.patch \ file://CVE-2026-47167.patch \ file://CVE-2026-55693.patch \ + file://CVE-2026-55892.patch \ " PV .= ".1683" From patchwork Thu Jul 23 09:23:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Siddharth X-Patchwork-Id: 93335 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7F052C531CF for ; Thu, 23 Jul 2026 09:26:27 +0000 (UTC) Received: from mail-pf1-f170.google.com (mail-pf1-f170.google.com [209.85.210.170]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.19552.1784798785064960883 for ; Thu, 23 Jul 2026 02:26:25 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@mvista.com header.s=google header.b=dFebYDLt; spf=pass (domain: mvista.com, ip: 209.85.210.170, mailfrom: sdoshi@mvista.com) Received: by mail-pf1-f170.google.com with SMTP id d2e1a72fcca58-84867f07d63so453989b3a.2 for ; Thu, 23 Jul 2026 02:26:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mvista.com; s=google; t=1784798784; x=1785403584; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=udBSS33EhUme1QDtTVbdyK+de985OCvLbCuBUuaI00s=; b=dFebYDLtUBFGU2Jqigb+FBS/bQuu8IsgPgXA7H5HXjk9oKo7PE623q5oe1izJhmgx/ 5683X99qMn1J9E/6eb8d5fqORuszw13l79mScpdPKuxhmhGw3Em2v26tORQ5/vQl8ERD kSxpbmYBjDr8gkQJFmaHKX14I0sJBvpjcwGHY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784798784; x=1785403584; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=udBSS33EhUme1QDtTVbdyK+de985OCvLbCuBUuaI00s=; b=iiaqOujf0Hq0Kpig/lJFqZKaVEx9uXQusBMhK4B1MGyeoiLvR5CpBCu4pLJPadvIkM qynRCxYd1TGWv3khpdvVkVuQ5pVoGYRp4L8IWmhUVOa/vxCVV/K50HxK9IisF5VMsHU5 FFdW72UaHt7e+wVVWeJDPsXfcFpWrSkXMmhC64WqkQNMrnkrpu2/l6gwYrmE0KeFvNHg aJCmkwkoX3TlQWh+Ud3AYlg3RDIi7R3V3fDdADLAiWkPxtuUgNWczAgc9P8x17YivOlt TYqFUYk9M63cRRol/1FUQT67v9wIDNqhFdqkelT++ZTP/6/j3GhHZ4PWGwvRT411vc34 KRRA== X-Gm-Message-State: AOJu0YwRPAndY37NUdWLbFuPAYa/q/cDjimx2AGC7beUdQSoTArc6BQk aDHF/VmTCRM0zqORmsGKJhBAZhQ/Tj9UBm2gmMQt4rSYPneqt6K7b7P7D8Dsyk8vehwyF5CZgEv tlBX2rfA= X-Gm-Gg: AR+sD125Bv4opE9pV3YvfkI3cUvZnxKtRk0ogbSyH1vt8K+ayVJCyfiEkwX9Jv08MFy yg9qerS5lc3g/ojg8MN9rY8tEQRXRSWv2zhNp2W2l6Kkhe5U5TZP5JWCvvCpoY+UymE6tTN/P5c kdDsyT1aqUa2+jdGK0NdEiv8xAwSXb6L1VLdncDSaWEhr3Hhs3DczwDUtaKaMnaCKShWDbNO+G7 Nhk3RJ3Uyhpr1nzapQ5H/KwCJI8DxJrylHQEg/IJNZIf/kGQvELKtUd/rmyXFFdxhTNMvOTmh4T C1p/mAELKbJ9lPoWG8ssPoWaF+dlMvMM1cgh6/uHQlL+CwPf0N02hzx3k+5z+cmdRsm8Yg3BIvp ylYSF0vSZNufXyw6iJx9XY5oq8JS2eEM9CbaATwiqppyN55b8EvXT3w0iC8HR3flT4VmvLAu0YI wtKUVwcrL0d/8= X-Received: by 2002:a05:6a21:50a:b0:3bf:a681:a262 with SMTP id adf61e73a8af0-3c44b18c987mr2441967637.38.1784798784418; Thu, 23 Jul 2026 02:26:24 -0700 (PDT) Received: from MVIN00030.mvista.com ([157.32.44.18]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147e1c7ff4sm19333788eec.27.2026.07.23.02.26.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 02:26:23 -0700 (PDT) From: Siddharth To: openembedded-core@lists.openembedded.org Cc: Siddharth Doshi Subject: [OE-core][scarthgap][PATCHv2 08/13] vim: Security Fix for CVE-2026-55895 Date: Thu, 23 Jul 2026 14:53:49 +0530 Message-Id: <20260723092354.54697-8-sdoshi@mvista.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260723092354.54697-1-sdoshi@mvista.com> References: <20260723092354.54697-1-sdoshi@mvista.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 23 Jul 2026 09:26:27 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241812 From: Siddharth Doshi Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-55895 [2] https://security-tracker.debian.org/tracker/CVE-2026-55895 Signed-off-by: Siddharth Doshi --- .../vim/files/CVE-2026-55895.patch | 53 +++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-55895.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-55895.patch b/meta/recipes-support/vim/files/CVE-2026-55895.patch new file mode 100644 index 0000000000..0084006b72 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-55895.patch @@ -0,0 +1,53 @@ +From 0d286458d71ff7b4d759621dd9a567aa9354819a Mon Sep 17 00:00:00 2001 +From: Yasuhiro Matsumoto +Date: Tue, 16 Jun 2026 21:00:28 +0000 +Subject: [PATCH 11/17] patch 9.2.0663: [security]: runtime(netrw): code + injection in local file deletion + +Problem: [security]: s:NetrwLocalRmFile() escapes only the backslash in + the file name before passing it to :execute, so a name + containing "|" injects arbitrary Ex commands when the file is + deleted (cipher-creator) +Solution: Use fnameescape() to correctly escape the file name + (Yasuhiro Matsumoto). + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-vhh8-v6wx-hjjh + +Supported by AI + +Signed-off-by: Yasuhiro Matsumoto +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/55bc757a5d436e59d50fe43f7cda94b118f86cb2] +CVE: CVE-2026-55895 +Signed-off-by: Siddharth Doshi +--- + runtime/pack/dist/opt/netrw/autoload/netrw.vim | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +index 9014ca339b..af43f469d1 100644 +--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim ++++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +@@ -3025,7 +3025,7 @@ function s:NetrwBrowse(islocal,dirname) + elseif !a:islocal && dirname !~ '[\/]$' && dirname !~ '^"' + " s:NetrwBrowse : remote regular file handler {{{3 + if bufname(dirname) != "" +- exe "NetrwKeepj b ".bufname(dirname) ++ exe "NetrwKeepj b ".fnameescape(bufname(dirname)) + else + " attempt transfer of remote regular file + +@@ -8737,7 +8737,7 @@ function s:NetrwLocalRmFile(path, fname, all) + call netrw#msg#Notify('ERROR', printf("unable to delete <%s>!", rmfile)) + else + " Remove file only if there are no pending changes +- execute printf('silent! bwipeout %s', rmfile) ++ execute printf('silent! bwipeout %s', fnameescape(rmfile)) + endif + + elseif dir && (all || empty(ok)) +-- +2.44.4 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 07f7b7dd16..bd1d52eaf6 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -43,6 +43,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \ file://CVE-2026-47167.patch \ file://CVE-2026-55693.patch \ file://CVE-2026-55892.patch \ + file://CVE-2026-55895.patch \ " PV .= ".1683" From patchwork Thu Jul 23 09:23:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Siddharth X-Patchwork-Id: 93340 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B7E12C531CD for ; Thu, 23 Jul 2026 09:26:37 +0000 (UTC) Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.19532.1784798788373459853 for ; Thu, 23 Jul 2026 02:26:28 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@mvista.com header.s=google header.b=i9vvD7d1; spf=pass (domain: mvista.com, ip: 209.85.214.177, mailfrom: sdoshi@mvista.com) Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2cf27856f9cso4593295ad.2 for ; Thu, 23 Jul 2026 02:26:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mvista.com; s=google; t=1784798788; x=1785403588; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=rSQRraOle1QLrghnX/FCOZLo2LHRjyDSf/hTehF+kqQ=; b=i9vvD7d14YnZMaeiaaqaCbVbTpiF/Gh3CmgHySrT668uRqoNvW2XRXQgnn3FpxebnL c2BW1joWNahu4htv0KTu6yHZy7abywYUxod0VYj4YS86+9s2wfoj+GsP27U4z5tIDSFq uOQ5T9HQ3uPBm1DsAYGGiz0AVXvaZBRqqoDbk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784798788; x=1785403588; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=rSQRraOle1QLrghnX/FCOZLo2LHRjyDSf/hTehF+kqQ=; b=ndtQCU1mpZ2gSXSTNgHXAj4N+QbubQoEnRUsc6A63uMlsJ59lW0W3eNG1WzFkFndl1 1JVDdYZWRqBsRl1QH+zd5Ca/VhfadAYfjGyAfQdMP7zmu+ftUI4bTO3WzmqtBUlmrLy+ aTXeHSAkvaGOdMqVf3/e8zVQBFsslgYDXnXqBQA1JDR2wYGyhRCnZbxWM/Sf9ruCo5Af oSwtURBhxUjqDqITF1GHnBV+9sIDXG3mpTQXmFzFAFBXfHFkOYibYCKWWHMd5UA1KsDx GzyPdm/AhmI6MbnUfrHxgvcfw9NlLgWtkhyMnyR95APJtCRpxuHW9lHd4CxHrLrmELrV 3a1Q== X-Gm-Message-State: AOJu0YyVwBVvVjbMizQv+YLpDdaoQ9Coo09pT5IQPvQHyHFrfeuRE1uS Da8vfYcgM0e8zmhR/A7soR2/fKPAYuIlRgVefGFgeKfHJ67YISEdMEo6mHYXf/mWIA78CrCA2ks DWiBbILg= X-Gm-Gg: AR+sD11Qku86TEmmiQhiB+9sfUnhRl0U+zXHn2b0r40GeFB/UuBZXr5tzDIAXS4OMbS IMwdFZ3ZqnuXrvGO1jYgwa8mBYX8G+T5+cPzpwoy7P7/436NLfjC+hMSzwcSDfpU1/Pp0BrS+2/ i+1J4aMmtSURyVIrkGNx1gfJtmiCrsvgCOqG82O+uapaeSfHbvKar1Qjhe5TQdcgAx8YkasfDAV ICSl12HtuScdePrw3qV2HiSLU1F0kGQYE6eyvOv816pxSeLNtqHFJ8B5DokDqWo+jcASo7EtMOW YbSaMhoXWhRsmO2P5Cf1qExNWX8K43Jw9emWrfALxaozcNOvIhPuE1gG7836/rdnMN4nVSnGGOO QKSpSLIcdweVJncIU7w7Hh2WbVOlqfoIg8py2sIFEJ7km+KrThWcMETZBIy5TbkZQgA+suX/uOG KScvN79bKI00I= X-Received: by 2002:a05:6300:648f:b0:3c4:2c02:eac0 with SMTP id adf61e73a8af0-3c44b243f4emr2558875637.65.1784798787609; Thu, 23 Jul 2026 02:26:27 -0700 (PDT) Received: from MVIN00030.mvista.com ([157.32.44.18]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147e1c7ff4sm19333788eec.27.2026.07.23.02.26.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 02:26:26 -0700 (PDT) From: Siddharth To: openembedded-core@lists.openembedded.org Cc: Siddharth Doshi Subject: [OE-core][scarthgap][PATCHv2 09/13] vim: Security Fix for CVE-2026-57452 Date: Thu, 23 Jul 2026 14:53:50 +0530 Message-Id: <20260723092354.54697-9-sdoshi@mvista.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260723092354.54697-1-sdoshi@mvista.com> References: <20260723092354.54697-1-sdoshi@mvista.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 23 Jul 2026 09:26:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241813 From: Siddharth Doshi Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-57452 [2] https://security-tracker.debian.org/tracker/CVE-2026-57452 Signed-off-by: Siddharth Doshi --- .../vim/files/CVE-2026-57452.patch | 76 +++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 77 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-57452.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-57452.patch b/meta/recipes-support/vim/files/CVE-2026-57452.patch new file mode 100644 index 0000000000..aaefbe80eb --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-57452.patch @@ -0,0 +1,76 @@ +From c8777cec25dcfae89c42e9aff51af61f71c5745f Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Thu, 18 Jun 2026 18:41:16 +0000 +Subject: [PATCH] patch 9.2.0671: [security]: possible out-of-bounds read with + sodium encrypted files + +Problem: [security]: possible out-of-bounds read with sodium encrypted + files (cipher-creator) +Solution: Verify that there is enough space before calling + crypto_secretstream_xchacha20poly1305_init_pull() + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-c4j9-wr9j-4486 + +Supported by AI + +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/c8777cec25dcfae89c42e9aff51af61f71c5745f] +CVE: CVE-2026-57452 +Signed-off-by: Siddharth Doshi +--- + src/crypt.c | 3 ++- + src/testdir/test_crypt.vim | 24 ++++++++++++++++++++++++ + 2 files changed, 26 insertions(+), 1 deletion(-) + +diff --git a/src/crypt.c b/src/crypt.c +index 55edd6c6de..a11d204e5e 100644 +--- a/src/crypt.c ++++ b/src/crypt.c +@@ -1257,7 +1257,8 @@ crypt_sodium_buffer_decode( + + if (sod_st->count == 0) + { +- if (crypto_secretstream_xchacha20poly1305_init_pull(&sod_st->state, ++ if (len < crypto_secretstream_xchacha20poly1305_HEADERBYTES || ++ crypto_secretstream_xchacha20poly1305_init_pull(&sod_st->state, + from, sod_st->key) != 0) + { + emsg(_(e_libsodium_decryption_failed_header_incomplete)); +diff --git a/src/testdir/test_crypt.vim b/src/testdir/test_crypt.vim +index 4a96c30702..151a4dea17 100644 +--- a/src/testdir/test_crypt.vim ++++ b/src/testdir/test_crypt.vim +@@ -459,4 +459,28 @@ func Test_crypt_set_key_disallow_append_subtract() + bwipe! + endfunc + ++func Test_crypt_sodium_short_body() ++ CheckFeature sodium ++ " A VimCrypt~04! file with a complete 36-byte header (12 magic + 16 salt + ++ " 8 seed) but a body shorter than one secretstream header (24 bytes) used to ++ " underflow the body length and crash with a wild out-of-bounds read in ++ " crypto_secretstream_xchacha20poly1305_pull(). It must now fail cleanly. ++ " Bytes: "VimCrypt~04!" + 16 salt + 8 seed + 8-byte body = 44 bytes. ++ call writefile(0z56696D43727970747E303421 ++ \ + 0zA0A1A2A3A4A5A6A7A8A9AAABACADAEAF ++ \ + 0zB0B1B2B3B4B5B6B7 ++ \ + 0z0000000000000000, 'Xtest_sodium_short') ++ ++ let v:errmsg = '' ++ try ++ call feedkeys(":split Xtest_sodium_short\foobar\", "xt") ++ catch /^Vim\%((\S\+)\)\=:E1198:/ ++ " no-op ++ endtry ++ ++ bwipe! ++ call delete('Xtest_sodium_short') ++ set key= ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +-- +2.44.4 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index bd1d52eaf6..567da7be0c 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -44,6 +44,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \ file://CVE-2026-55693.patch \ file://CVE-2026-55892.patch \ file://CVE-2026-55895.patch \ + file://CVE-2026-57452.patch \ " PV .= ".1683" From patchwork Thu Jul 23 09:23:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Siddharth X-Patchwork-Id: 93341 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B24CEC531CF for ; Thu, 23 Jul 2026 09:26:37 +0000 (UTC) Received: from mail-pg1-f171.google.com (mail-pg1-f171.google.com [209.85.215.171]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.19553.1784798790776570920 for ; Thu, 23 Jul 2026 02:26:30 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@mvista.com header.s=google header.b=N0sYuUAC; spf=pass (domain: mvista.com, ip: 209.85.215.171, mailfrom: sdoshi@mvista.com) Received: by mail-pg1-f171.google.com with SMTP id 41be03b00d2f7-caf45fc5202so433579a12.1 for ; Thu, 23 Jul 2026 02:26:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mvista.com; s=google; t=1784798790; x=1785403590; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=tzws/VPXReLb9Ubo3W/dFLZ+ECn9wb3Sdu7cPsznnqQ=; b=N0sYuUACvdXzB+IazzkYPGr/w7of+2xLYw+xQmMnSKvENxrsMtxnQxvT6Guhe7Ec1W Kk9YD8LI+8vrTHf2juhE43deflChh9FycMxeUxlSZKvk3+0M57/GQdPvXfPyosf25Ktq 8Tw4LYZpaIWiJ5yVde0cTsksHBOQzD57yzleM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784798790; x=1785403590; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=tzws/VPXReLb9Ubo3W/dFLZ+ECn9wb3Sdu7cPsznnqQ=; b=QENZ+OF67hYqCU6jKLKM6pO7YfsMZ6I+Wvp12sgwHDObCqQrj/GhgOKMIJrsz+xEmz 8nkRT6jPbSoR+EPpMxL0f8Bzq3/an9kDLlAKS2GJZKKXQWcgcswHcPM8G5y9Hwfzduex qgOW3JyKDdGVnhpSTw9OuMeZWxrCtxy2Xjk1lz3DzlT2s8svx3JCUaGJSdZfFTW8mClt WFx67GT9z1lUCcxQu/6cGteoejpc4PlgHy1/1XH1TKLoQh0JMQIIqyU34q5CdMI5NzTK X7a1p6LeKZpvJGph3bmIGGN6qBWxH+NVn6fKH0gMaoraUpV9NFDl7AT+xGcY0TfiFvnu WnRA== X-Gm-Message-State: AOJu0YwYyutPriJTnvpo1jXpppdTjLkERUsZnglbctVq35mVV8zN33AC 41h1QD2/hzC408MIaj+2BfgWehiL9qa3vY/HLR4uNdhlf+N3uRsBRxbeRi1JwrZqNPgTZizemjx BilCn7gE= X-Gm-Gg: AR+sD12Gy2Q9ml03F/f1xcGQcvSYcORNSmJdOJlinz0NH+6XguUddaxxpuyXKSsSUNz WHBerd2GHVg6gsGQqPxcwdGl8oRvNUHpG4o5ud05PL6Q8lGdlEtIye4XOlJVld+bxFkDG7stZ9E fbVzDux2UbAx2FRsaOUXlEnRccP9O3bH53G0+4jGR5KB5fZJye4XjCdig/0ZAdHwaJFyGuNKZlW 4hkFN199JKuS1Iv9NSRUsL9zoDhm+W4xXuv4OGCce5ku5eAUR8Htsghc8pJtMY3B/BOPk8CennH siT+h927jBO3KSbIOlEmXLZhuZYNUrEG9LS6oYWt6fHsreEtQs+RWk8+Ngufe40uawak+Cb+y9i 88KIAAZZC7IrG8zew/sjHsxoC0myhAf5ncW057SrjrvAzFO5ycunxHkL9+dV+jh0ULAtllVzMsq KYyJ0QDHCLWkE= X-Received: by 2002:a05:6a20:b68a:b0:3c4:3b16:2979 with SMTP id adf61e73a8af0-3c44b051f78mr2372112637.30.1784798790107; Thu, 23 Jul 2026 02:26:30 -0700 (PDT) Received: from MVIN00030.mvista.com ([157.32.44.18]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147e1c7ff4sm19333788eec.27.2026.07.23.02.26.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 02:26:29 -0700 (PDT) From: Siddharth To: openembedded-core@lists.openembedded.org Cc: Siddharth Doshi Subject: [OE-core][scarthgap][PATCHv2 10/13] vim: Security Fix for CVE-2026-57455 Date: Thu, 23 Jul 2026 14:53:51 +0530 Message-Id: <20260723092354.54697-10-sdoshi@mvista.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260723092354.54697-1-sdoshi@mvista.com> References: <20260723092354.54697-1-sdoshi@mvista.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 23 Jul 2026 09:26:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241814 From: Siddharth Doshi Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-57455 [2] https://security-tracker.debian.org/tracker/CVE-2026-57455 Signed-off-by: Siddharth Doshi --- .../vim/files/CVE-2026-57455.patch | 72 +++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 73 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-57455.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-57455.patch b/meta/recipes-support/vim/files/CVE-2026-57455.patch new file mode 100644 index 0000000000..722238c794 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-57455.patch @@ -0,0 +1,72 @@ +From 497d2fb19b2af9bccf139bb910e4f91b583e769d Mon Sep 17 00:00:00 2001 +From: Christian Brabandt +Date: Sun, 21 Jun 2026 19:20:03 +0000 +Subject: [PATCH 13/17] patch 9.2.0698: [security]: Out-of-bounds write with + soundfold() + +Problem: [security]: Out-of-bounds write with soundfold() + (cipher-creator) +Solution: Add an abort condition to the for loop to validate the buffer + size. + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4 + +Supported by AI + +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b] +CVE: CVE-2026-57455 +Signed-off-by: Siddharth Doshi +--- + src/spell.c | 2 +- + src/testdir/test_spellfile.vim | 21 +++++++++++++++++++++ + 2 files changed, 22 insertions(+), 1 deletion(-) + +diff --git a/src/spell.c b/src/spell.c +index 6ef3fa899b..a7909ef46e 100644 +--- a/src/spell.c ++++ b/src/spell.c +@@ -3273,7 +3273,7 @@ spell_soundfold_sofo(slang_T *slang, char_u *inword, char_u *res) + else + { + // The sl_sal_first[] table contains the translation. +- for (s = inword; (c = *s) != NUL; ++s) ++ for (s = inword; (c = *s) != NUL && ri < MAXWLEN - 1; ++s) + { + if (VIM_ISWHITE(c)) + c = ' '; +diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim +index e5f8c5778f..d04d024911 100644 +--- a/src/testdir/test_spellfile.vim ++++ b/src/testdir/test_spellfile.vim +@@ -1193,4 +1193,25 @@ func Test_spell_sug_tree_count_words_overflow() + bwipe! + endfunc + ++" A word longer than MAXWLEN must not overflow the soundfold result buffer in ++" the single-byte SOFO branch of spell_soundfold_sofo(). ++func Test_soundfold_overflow() ++ let _enc=&enc ++ set enc=latin1 ++ call writefile(['SOFOFROM ab', 'SOFOTO xy'], 'Xtest.aff', 'D') ++ call writefile(['1', 'foo'], 'Xtest.dic', 'D') ++ mkspell! Xtest Xtest ++ defer delete('Xtest.latin1.spl') ++ defer delete('Xtest.latin1.sug') ++ setl spelllang=Xtest.latin1.spl spell ++ ++ " Before the fix the copy loop wrote one byte per input byte into a ++ " MAXWLEN (254) stack buffer with no upper bound, smashing the stack. ++ let sound = soundfold(repeat('ab', 300)) ++ call assert_true(strlen(sound) < 254, 'soundfold result exceeds MAXWLEN') ++ ++ set spell& spelllang& ++ let &enc = _enc ++endfunc ++ + " vim: shiftwidth=2 sts=2 expandtab +-- +2.44.4 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 567da7be0c..8794f831b0 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -45,6 +45,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \ file://CVE-2026-55892.patch \ file://CVE-2026-55895.patch \ file://CVE-2026-57452.patch \ + file://CVE-2026-57455.patch \ " PV .= ".1683" From patchwork Thu Jul 23 09:23:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Siddharth X-Patchwork-Id: 93339 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 963D2C531C7 for ; Thu, 23 Jul 2026 09:26:37 +0000 (UTC) Received: from mail-pg1-f171.google.com (mail-pg1-f171.google.com [209.85.215.171]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.19554.1784798793574630070 for ; Thu, 23 Jul 2026 02:26:33 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@mvista.com header.s=google header.b=NPTrH3nG; spf=pass (domain: mvista.com, ip: 209.85.215.171, mailfrom: sdoshi@mvista.com) Received: by mail-pg1-f171.google.com with SMTP id 41be03b00d2f7-ca97d139d8dso260945a12.2 for ; Thu, 23 Jul 2026 02:26:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mvista.com; s=google; t=1784798793; x=1785403593; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=xcrC88SHTY9tP755hd23D96FOs0pRRkrMq7CLcFnWhI=; b=NPTrH3nG/9+RtNPaww+Dk36mJtCj1ZRoc6O8uOyiIpqdPjVP6szqgTJGeBRwjzNl/v Pdg7A/tyI4RA+OHysuttOWok3yELt2qaK3l9cQSHIjjg7yUk2Vv5fmPK2fP2OiIw7naY IzaXBgFE0+0YsDnIXbA8tBrBZJ7zLLzDzpRXU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784798793; x=1785403593; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=xcrC88SHTY9tP755hd23D96FOs0pRRkrMq7CLcFnWhI=; b=OosDESmH6i+CuC3Ja2pWyd1CMf2IQkQt4UL/IHns+zqgZjCsND1MolgHczdD69GwMg 2MzcpiAsnIZCMPNH1KCsruS9BOtdGXRkOJqnyLdsudjPxP3zN90GR20FdLbc7IpUjOJl Y0jM1Whi63HGPZPLirKCr3QMihp7higfEiMk2s6n6PEvl0TI8JdOb0keYydBgJBHx8E+ 3bbiFx1ynODlqDgy5b+jYBDsOQQozDszS6g2PfZw2WTSlCfUZZZK8lmtezSPv4A0tNnW UXi45DuK2vDFV/WCF7cHtsWcXADIut0Vaa46ZQaHjZBi00kaHitpI6nVA5jt/LX2p/T0 BQ3g== X-Gm-Message-State: AOJu0YzC2OZ3Ns6eNNmvvYvr1iP56DC5DafPzq6BwtkKOPAvap+nd/Ot DjSLWIRQqe/alG0+9dHoipd2nheO8dAUV8BijRxualcbImFL97JWCGFvENn4/QwII6Y/4QoRwcp C0MYY0JI= X-Gm-Gg: AR+sD10MSdZlWiYuGidkTsdjQU7lJkJPk2W+t1QSsEDKgrCSz98UkAVHFGDYgStwfzE Di754hi7NNV2FEXtkwQoU3/2+qL9+Ol9FoYOmE8VFE3I1Ga1IrViVoWYDHwA+fssqJTXlqWWjzL BGiu4AcCQgPIvdgF0jZqz/E5Z+5OnwI44eCsHj/9Oo4ghkqxDAskH87VlnCeCHgxr0/DzYXhZ+9 HPERF3amdxk15N0CXaeg+aGScYDH9ZMNfTGEzlU92kyBE50296YlHBIrax+GToYswM3UfOqQAQU dA7eLrsRrQnryly4Gx2w0bPTiEBSnpJBd8l5Uxo6w13zYM1aSwd/6NoKB52hO2Gqfc3kC5Wx/PZ efo71OoT3HUW4wJfyYs2ZZS7A6bmzq4crur/UICAeAZB7ZrFyW1JVm/sjZ9Fv44oMZCduMXm+pF usZRp0vb1mX+Q= X-Received: by 2002:a05:6a21:2d4b:b0:3c0:4269:47bb with SMTP id adf61e73a8af0-3c44b1d93a8mr2399071637.52.1784798792893; Thu, 23 Jul 2026 02:26:32 -0700 (PDT) Received: from MVIN00030.mvista.com ([157.32.44.18]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147e1c7ff4sm19333788eec.27.2026.07.23.02.26.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 02:26:32 -0700 (PDT) From: Siddharth To: openembedded-core@lists.openembedded.org Cc: Siddharth Doshi Subject: [OE-core][scarthgap][PATCHv2 11/13] vim: Security Fix for CVE-2026-59856 Date: Thu, 23 Jul 2026 14:53:52 +0530 Message-Id: <20260723092354.54697-11-sdoshi@mvista.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260723092354.54697-1-sdoshi@mvista.com> References: <20260723092354.54697-1-sdoshi@mvista.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 23 Jul 2026 09:26:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241815 From: Siddharth Doshi Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-59856 [2] https://security-tracker.debian.org/tracker/CVE-2026-59856 Signed-off-by: Siddharth Doshi --- .../vim/files/CVE-2026-59856.patch | 103 ++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 104 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-59856.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-59856.patch b/meta/recipes-support/vim/files/CVE-2026-59856.patch new file mode 100644 index 0000000000..01267460d1 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-59856.patch @@ -0,0 +1,103 @@ +From 43afc581a37a35762dd0ef292f038b9dc5680a24 Mon Sep 17 00:00:00 2001 +From: Hirohito Higashi +Date: Fri, 26 Jun 2026 20:07:01 +0900 +Subject: [PATCH] patch 9.2.0736: potential command execution in PHP + omni-completion + +Problem: With PHP omni-completion, a crafted file can potentially + execute arbitrary commands when completing a class member. +Solution: Quote the class name before inserting it into the search() + pattern run via win_execute(). + +Co-Authored-By: Claude Opus 4.8 (1M context) +Signed-off-by: Hirohito Higashi +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24] +CVE: CVE-2026-59856 +Signed-off-by: Siddharth Doshi +--- + runtime/autoload/phpcomplete.vim | 3 ++- + src/testdir/Make_all.mak | 2 ++ + src/testdir/test_plugin_phpcomplete.vim | 35 +++++++++++++++++++++++++ + 3 files changed, 39 insertions(+), 1 deletion(-) + create mode 100644 src/testdir/test_plugin_phpcomplete.vim + +diff --git a/runtime/autoload/phpcomplete.vim b/runtime/autoload/phpcomplete.vim +index 5b4263ae45..93f7d8b450 100644 +--- a/runtime/autoload/phpcomplete.vim ++++ b/runtime/autoload/phpcomplete.vim +@@ -2082,7 +2082,8 @@ function! phpcomplete#GetClassContentsStructure(file_path, file_lines, class_nam + let result = [] + let popup_id = popup_create(a:file_lines, {'hidden': v:true}) + +- call win_execute(popup_id, 'call search(''\c\(class\|interface\|trait\)\_s\+'.a:class_name.'\(\>\|$\)'')') ++ call win_execute(popup_id, 'call search(' ++ \ . string('\c\(class\|interface\|trait\)\_s\+' . a:class_name . '\(\>\|$\)') . ')') + call win_execute(popup_id, "let cfline = line('.')") + call win_execute(popup_id, "call search('{')") + call win_execute(popup_id, "let endline = line('.')") +diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak +index 0d4aeb0432..7d57b2e727 100644 +--- a/src/testdir/Make_all.mak ++++ b/src/testdir/Make_all.mak +@@ -248,6 +248,7 @@ NEW_TESTS = \ + test_plugin_man \ + test_plugin_matchparen \ + test_plugin_python3complete \ ++ test_plugin_phpcomplete \ + test_plugin_tar \ + test_plugin_termdebug \ + test_plugin_tohtml \ +@@ -522,6 +523,7 @@ NEW_TESTS_RES = \ + test_plugin_man.res \ + test_plugin_matchparen.res \ + test_plugin_python3complete.res \ ++ test_plugin_phpcomplete.res \ + test_plugin_tar.res \ + test_plugin_termdebug.res \ + test_plugin_tohtml.res \ + +diff --git a/src/testdir/test_plugin_phpcomplete.vim b/src/testdir/test_plugin_phpcomplete.vim +new file mode 100644 +index 0000000000..7f66be47b7 +--- /dev/null ++++ b/src/testdir/test_plugin_phpcomplete.vim +@@ -0,0 +1,35 @@ ++" Tests for the PHP omni-completion plugin (runtime/autoload/phpcomplete.vim). ++ ++" A buffer class name is interpolated into a search() pattern run via ++" win_execute(). Without escaping, "'" closes the string and "|" starts a new ++" Ex command, so the name runs as an Ex command during completion. ++func Test_phpcomplete_no_exec_via_class_name() ++ unlet! g:phpcomplete_injected ++ let lines = [' 0, 'no class structure returned') ++ call assert_match('class Foo', result[0].content, ++ \ 'class body missing from returned content') ++ call assert_match('bar', result[0].content, ++ \ 'class member missing from returned content') ++endfunc ++ ++" vim: shiftwidth=2 sts=2 expandtab +-- +2.44.4 diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 8794f831b0..37a965429a 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -46,6 +46,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \ file://CVE-2026-55895.patch \ file://CVE-2026-57452.patch \ file://CVE-2026-57455.patch \ + file://CVE-2026-59856.patch \ " PV .= ".1683" From patchwork Thu Jul 23 09:23:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Siddharth X-Patchwork-Id: 93338 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4CE0C531CB for ; Thu, 23 Jul 2026 09:26:37 +0000 (UTC) Received: from mail-pg1-f177.google.com (mail-pg1-f177.google.com [209.85.215.177]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.19534.1784798796639022037 for ; Thu, 23 Jul 2026 02:26:36 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@mvista.com header.s=google header.b=g/f4yOj6; spf=pass (domain: mvista.com, ip: 209.85.215.177, mailfrom: sdoshi@mvista.com) Received: by mail-pg1-f177.google.com with SMTP id 41be03b00d2f7-ca80d708489so166479a12.1 for ; Thu, 23 Jul 2026 02:26:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mvista.com; s=google; t=1784798796; x=1785403596; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=0T1B026Rh/sJ5RQJ5c8aElFI77kejRT1urnU+9BwSyQ=; b=g/f4yOj6LnM78mZjiKUJ623JutIvG20VcMYH/fBVGF6DaJGq+8H1PFqsTbkZnyU6nH fUdeKxGquKCAu420nJJC9B6DFUOtk5ChWr2QdXkwUkK/nj+OIMlWI860X5+trSTwzB88 HUilL+AaStHe+CWJXJQPgtNFud6z8yWLWM6mk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784798796; x=1785403596; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=0T1B026Rh/sJ5RQJ5c8aElFI77kejRT1urnU+9BwSyQ=; b=LdxQqg34+cV0GobMwlDsM60RUN5vS15Z/dR0gNVYqWBIkwKvDwXiogzkafSqH+3NbX 0P04UYJWO8AiNB4pCdoYCMUSfCChltdq/+QJTOmJogl2SMQMIhrQd5ly1kMVk6UWd/7s eGZJN2MRLiZEw6EK0/aXQZoytyElSaCEOV7mGmdBWHjK9fPSoltnH63l7aXzPqjFB62x RAgh6Zi8jQmNNbPqJgLlxYFFDZdzLxAZNQOJW07BaC5O8n1WOmBZseNts/1te260lHLL 8Puhn5Lc0mAniK2rfebykO9LWl3HH3P1DqIfEn9rOOGRS99NYbRTeiPdFM8M9Ndz8UCZ nFxw== X-Gm-Message-State: AOJu0YzfRyFfygwA87QXZlW5/oFVdaN+87T9EZhF/DQetIVyPJ0kOBrX AhMLv//2AkC7bpNKskdQoEpyoP2vmhveMGgdpcTK+lbpStH8gJ51xTprc1EEwH6U8xtaS421h0P yybkk6b8= X-Gm-Gg: AR+sD10coMvmBDsA0dXmnyvmzHzKcityf1VZQEX/MceE04+w1ZaK/JqGDNXGPW8ulX+ 1XzcK/NL/H5wrtLIF4il8zZl4wcaW6GbAO9NPh9hFfoDwwwk7MUnxnZWYl0NlvMOmXDXPxo8Zfo 5lwwaG465/MmRMERcikpIxGEF3grtIY7/thsCRp1fk2LZRWW0yc0HYFKknRzqhFEahihldMoglJ 1KQbVgFyU6g55gSS83z71KMX3tRsDUm0gqh1ZeusIp7Xv1FEfgtdz9M5IDel874bEqWj0hAm4v7 5uHc5BeO3nDI8qUVfNce/uJzfriGQYPMIS7KEp85Ck3QvmmMSAOR/yv2n7utDW+N575hx/Vpt8L cc8Mx+rqzKu89YpQGBHVbSkh3VFg71SIDKL86GZ40l3lSdM5urg1xLJnvwS3lUFF1cXsPIuLldL vPXpzKpPLYgMLXVVhZxopFwg== X-Received: by 2002:a05:6a20:6a26:b0:3c4:2f75:719 with SMTP id adf61e73a8af0-3c44cd1de09mr2178964637.37.1784798795952; Thu, 23 Jul 2026 02:26:35 -0700 (PDT) Received: from MVIN00030.mvista.com ([157.32.44.18]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147e1c7ff4sm19333788eec.27.2026.07.23.02.26.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 02:26:35 -0700 (PDT) From: Siddharth To: openembedded-core@lists.openembedded.org Cc: Siddharth Doshi Subject: [OE-core][scarthgap][PATCHv2 12/13] vim: Security Fix for CVE-2026-59857 Date: Thu, 23 Jul 2026 14:53:53 +0530 Message-Id: <20260723092354.54697-12-sdoshi@mvista.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260723092354.54697-1-sdoshi@mvista.com> References: <20260723092354.54697-1-sdoshi@mvista.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 23 Jul 2026 09:26:37 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241816 From: Siddharth Doshi Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-59857 [2] https://security-tracker.debian.org/tracker/CVE-2026-59857 Signed-off-by: Siddharth Doshi --- .../vim/files/CVE-2026-59857.patch | 110 ++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 111 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-59857.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-59857.patch b/meta/recipes-support/vim/files/CVE-2026-59857.patch new file mode 100644 index 0000000000..ed92190a95 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-59857.patch @@ -0,0 +1,110 @@ +From 48287480f53acfb5e6f9172e571ed2f0508dfab2 Mon Sep 17 00:00:00 2001 +From: Hirohito Higashi +Date: Mon, 22 Jun 2026 13:00:36 +0900 +Subject: [PATCH 16/17] patch 9.2.0725: [security]: Stack out-of-bounds write + in spell_soundfold_sal() + +Problem: [security]: A crafted spell file with non-collapsing SAL rules + can make soundfold() write one byte past the end of the + MAXWLEN result buffer. This is the same class of + out-of-bounds write as GHSA-q8mh-6qm3-25g4 (fixed in 9.2.0698 + for the SOFO branch), found while auditing the surrounding + code. +Solution: Bound the single-byte SAL result writes and the terminating + NUL to MAXWLEN - 1, matching the SOFO branch. + +The single-byte branch of spell_soundfold_sal() guarded its writes with +"reslen < MAXWLEN", allowing reslen to reach MAXWLEN (254). The trailing +"res[reslen] = NUL" then wrote at index 254 of the 254-byte stack buffer +res[MAXWLEN], an off-by-one out-of-bounds write. Input is case-folded to +about 253 characters, so a 253-character argument together with a SAL map +that does not collapse (collapse_result false) reaches the boundary. + +Related to previous issue +[GHSA-q8mh-6qm3-25g4](https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4) +(9.2.0698) + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-m3hf-xcm3-xhm2 + +Co-Authored-By: Claude Opus 4.8 (1M context) +Signed-off-by: Hirohito Higashi +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/d22ff1c955ff87e8273210eae125aab0e85b6c30] +CVE: CVE-2026-59857 +Signed-off-by: Siddharth Doshi +--- + src/spell.c | 6 +++--- + src/testdir/test_spellfile.vim | 24 ++++++++++++++++++++++++ + 2 files changed, 27 insertions(+), 3 deletions(-) + +diff --git a/src/spell.c b/src/spell.c +index a7909ef46e..05d6f0159d 100644 +--- a/src/spell.c ++++ b/src/spell.c +@@ -3516,7 +3516,7 @@ spell_soundfold_sal(slang_T *slang, char_u *inword, char_u *res) + // no '<' rule used + i += k - 1; + z = 0; +- while (*s != NUL && s[1] != NUL && reslen < MAXWLEN) ++ while (*s != NUL && s[1] != NUL && reslen < MAXWLEN - 1) + { + if (reslen == 0 || res[reslen - 1] != *s) + res[reslen++] = *s; +@@ -3526,7 +3526,7 @@ spell_soundfold_sal(slang_T *slang, char_u *inword, char_u *res) + c = *s; + if (strstr((char *)pf, "^^") != NULL) + { +- if (c != NUL) ++ if (c != NUL && reslen < MAXWLEN - 1) + res[reslen++] = c; + STRMOVE(word, word + i + 1); + i = 0; +@@ -3545,7 +3545,7 @@ spell_soundfold_sal(slang_T *slang, char_u *inword, char_u *res) + + if (z0 == 0) + { +- if (k && !p0 && reslen < MAXWLEN && c != NUL ++ if (k && !p0 && reslen < MAXWLEN - 1 && c != NUL + && (!slang->sl_collapse || reslen == 0 + || res[reslen - 1] != c)) + // condense only double letters +diff --git a/src/testdir/test_spellfile.vim b/src/testdir/test_spellfile.vim +index d04d024911..c8c7ac2642 100644 +--- a/src/testdir/test_spellfile.vim ++++ b/src/testdir/test_spellfile.vim +@@ -383,6 +383,30 @@ func Test_spellfile_format_error() + let &rtp = save_rtp + endfunc + ++" An over-length soundfold() argument must not overflow the MAXWLEN result ++" buffer in the single-byte branch of spell_soundfold_sal(). ++func Test_spellfile_soundfold_sal_overflow() ++ let save_enc = &encoding ++ set encoding=latin1 ++ " A SAL map that appends without collapsing, so the result is not shorter ++ " than the input. ++ call writefile(['SET ISO8859-1', 'SAL collapse_result false', ++ \ 'SAL a aaaa', 'SAL b bbbb'], 'Xsal.aff') ++ call writefile(['2', 'hello', 'world'], 'Xsal.dic') ++ mkspell! Xsal Xsal ++ set spl=Xsal.latin1.spl spell ++ ++ " 253 input characters hit the buffer boundary; the result must not exceed ++ " MAXWLEN - 1. ++ call assert_true(strlen(soundfold(repeat('a', 253))) <= 253) ++ ++ set nospell spl& spelllang& ++ call delete('Xsal.aff') ++ call delete('Xsal.dic') ++ call delete('Xsal.latin1.spl') ++ let &encoding = save_enc ++endfunc ++ + " Test for format errors in suggest file + func Test_sugfile_format_error() + let save_rtp = &rtp +-- +2.44.4 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 37a965429a..a484a5c840 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -47,6 +47,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \ file://CVE-2026-57452.patch \ file://CVE-2026-57455.patch \ file://CVE-2026-59856.patch \ + file://CVE-2026-59857.patch \ " PV .= ".1683" From patchwork Thu Jul 23 09:23:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Siddharth X-Patchwork-Id: 93342 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B6D1EC531CD for ; Thu, 23 Jul 2026 09:26:47 +0000 (UTC) Received: from mail-pg1-f175.google.com (mail-pg1-f175.google.com [209.85.215.175]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.19535.1784798799089827130 for ; Thu, 23 Jul 2026 02:26:39 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@mvista.com header.s=google header.b=VLo/YOjI; spf=pass (domain: mvista.com, ip: 209.85.215.175, mailfrom: sdoshi@mvista.com) Received: by mail-pg1-f175.google.com with SMTP id 41be03b00d2f7-ca97d139d8dso260988a12.2 for ; Thu, 23 Jul 2026 02:26:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mvista.com; s=google; t=1784798798; x=1785403598; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=aMcshy9tyt6fANbCeJ2Ec9AeGqNgaZCF4mNCTz7/BB8=; b=VLo/YOjIa/ubOSM6068WrXV1XNheVuye/J0TTK7+iPj+9Q0+OVexFXsY9pF+gjlY2G GpED+lkhQKm/m/Q1W+N1RRNFl4enXqFzUflYqOnQNKvLTkr1v2XNGg26RWGX4fLEDQI7 sZURLF5sJRxQKf52hR3OeDB4ML2S5OSQ4C358= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784798798; x=1785403598; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=aMcshy9tyt6fANbCeJ2Ec9AeGqNgaZCF4mNCTz7/BB8=; b=G3QqnTelF4hlsQ6ZTfv/JBNJ0Y5ytarVBZuN0jLgdmiEF1QNQXw706Cly0pGSYehkp Y0Qve2EyNI6vv1n1HGBNE/FBl+k8+mNEjy8TxxuSFVBU2zSbmz2mr/DT0MZUJ5Ack78g ltUsnZBNa45diYndy10Q1Y7wsQupCAGDIQiRtbixTtN65btYKRa7RSmT9FwjVmu+7TZV Q/HNwvgu/DUjrPeflMhnmNoY4PUjufvOz1Nql7atIQJEMDySSi482/HRThZEBTb38/nz FvCeHevWcMbhFMVR9+2LUVJLAdYFEXAxSCMa8OITtlVeK4Abm+uTLqPQV+vCXf9f0HHU N8mA== X-Gm-Message-State: AOJu0YzikAD+oCh3oxsKcBhZ/WD7lDddKk/ItnwVk/Z3bdjhMAT6ry/v SHz7tO4GE85uM+B8jU8TB4RzCR+sNZOI4I3RgXjHvSGbtDjaHscws67tVDFVTTelRLiHnMI/1he 5e6ia1NE= X-Gm-Gg: AR+sD13PSYaRfRWWluCcQtcOEa+biKyI0uy6pJ7yf6MG+P8MwFZ88CmfgESEaFKLbCI qV2ElKBo9+H2Q675cb3icYoWZgSkcB9RqoHc4QnsTYRyusbrYKjIx/FU5zXcFQiF517Iurq1vGQ ru3GWKCxbl1V14rwFn98UBe7TX0WTasYiYqsdqfruM9l+AXeyp0wRw3mVZ2+0obaP0c+pYdYGhp iG31LAxADTMqbq+7lh51yGmzPtlxq9wFyLphmen/MIeHsGkzbcsL6X2to7AFWx+c4DyKp63kwMC VTLXmIfHY7f1vrtpL0s4ii1rg7Qc4mw5YXIiwFqocOymP6pTuM4PYADjdET6vFXn4HLrV3B43u4 rWNy8tFuKEkhfhGvmMyRknzkJHAQyrylZ8l21PWl3X0FKmxQWgvyWknelz04PbUD2XXrK61a/cP e5kaPgJrm8XFQ= X-Received: by 2002:a05:6a21:6b87:b0:3c3:824d:5200 with SMTP id adf61e73a8af0-3c44b157945mr2551990637.41.1784798798336; Thu, 23 Jul 2026 02:26:38 -0700 (PDT) Received: from MVIN00030.mvista.com ([157.32.44.18]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147e1c7ff4sm19333788eec.27.2026.07.23.02.26.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 02:26:37 -0700 (PDT) From: Siddharth To: openembedded-core@lists.openembedded.org Cc: Siddharth Doshi Subject: [OE-core][scarthgap][PATCHv2 13/13] vim: Security Fix for CVE-2026-59858 Date: Thu, 23 Jul 2026 14:53:54 +0530 Message-Id: <20260723092354.54697-13-sdoshi@mvista.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260723092354.54697-1-sdoshi@mvista.com> References: <20260723092354.54697-1-sdoshi@mvista.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 23 Jul 2026 09:26:47 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/241817 From: Siddharth Doshi Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-59858 [2] https://security-tracker.debian.org/tracker/CVE-2026-59858 Signed-off-by: Siddharth Doshi --- .../vim/files/CVE-2026-59858.patch | 134 ++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 135 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-59858.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-59858.patch b/meta/recipes-support/vim/files/CVE-2026-59858.patch new file mode 100644 index 0000000000..0b754ec2d3 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-59858.patch @@ -0,0 +1,134 @@ +From 6b611b0d15603c52ebdad17172b0232b4f65704e Mon Sep 17 00:00:00 2001 +From: Hirohito Higashi +Date: Fri, 26 Jun 2026 15:41:24 +0900 +Subject: [PATCH] patch 9.2.0735: [security]: arbitrary Ex command execution + during C omni-completion + +Problem: [security]: With C omni-completion, a crafted tags file can execute + arbitrary Ex commands when completing a struct/union member + (cipher-creator) +Solution: Escape the type field before inserting it into the :vimgrep + pattern so it cannot close the pattern and start a new command + (Hirohito Higashi). + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x + +Co-Authored-By: Claude Opus 4.8 (1M context) " +Signed-off-by: Hirohito Higashi +Signed-off-by: Christian Brabandt + +Upstream-Status: Backport [https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e] +CVE: CVE-2026-59858 +Signed-off-by: Siddharth Doshi +--- + runtime/autoload/ccomplete.vim | 2 +- + src/testdir/Make_all.mak | 2 + + src/testdir/test_plugin_ccomplete.vim | 62 +++++++++++++++++++++++++++ + 3 files changed, 65 insertions(+), 1 deletion(-) + create mode 100644 src/testdir/test_plugin_ccomplete.vim + +diff --git a/runtime/autoload/ccomplete.vim b/runtime/autoload/ccomplete.vim +index cb4bb2c167..248d6f2e60 100644 +--- a/runtime/autoload/ccomplete.vim ++++ b/runtime/autoload/ccomplete.vim +@@ -593,7 +593,7 @@ def StructMembers( # {{{1 + return [] + endif + execute 'silent! keepjumps noautocmd ' +- .. n .. 'vimgrep ' .. '/\t' .. typename .. '\(\t\|$\)/j ' ++ .. n .. 'vimgrep ' .. '/\t' .. escape(typename, '/\') .. '\(\t\|$\)/j ' + .. fnames + + qflist = getqflist() +diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak +index 7d57b2e727..681e9b3b2a 100644 +--- a/src/testdir/Make_all.mak ++++ b/src/testdir/Make_all.mak +@@ -242,6 +242,7 @@ NEW_TESTS = \ + test_partial \ + test_paste \ + test_perl \ ++ test_plugin_ccomplete \ + test_plugin_comment \ + test_plugin_glvs \ + test_plugin_helptoc \ +@@ -516,6 +517,7 @@ NEW_TESTS_RES = \ + test_partial.res \ + test_paste.res \ + test_perl.res \ ++ test_plugin_ccomplete.res \ + test_plugin_comment.res \ + test_plugin_glvs.res \ + test_plugin_helptoc.res \ +diff --git a/src/testdir/test_plugin_ccomplete.vim b/src/testdir/test_plugin_ccomplete.vim +new file mode 100644 +index 0000000000..a635bd50bd +--- /dev/null ++++ b/src/testdir/test_plugin_ccomplete.vim +@@ -0,0 +1,62 @@ ++" Tests for the C omni-completion plugin (runtime/autoload/ccomplete.vim). ++ ++func s:WriteTags(lines) ++ " Mark unsorted so lookup is a linear scan regardless of entry order. ++ let tagsfile = tempname() ++ call writefile(["!_TAG_FILE_SORTED\t0\t/0/"] + a:lines, tagsfile) ++ return tagsfile ++endfunc ++ ++" A crafted typeref field is interpolated into the :vimgrep pattern in ++" StructMembers(). Without escaping, "/" closes the pattern and "|" starts a ++" new Ex command, so the field runs as an Ex command during completion. ++func Test_ccomplete_no_exec_via_typeref() ++ unlet! g:ccomplete_injected ++ let tagsfile = s:WriteTags([ ++ \ "myvar\tmain.c\t/^x$/;\"\tv\ttyperef:x/|let g:ccomplete_injected = 1|\"", ++ \ ]) ++ ++ let save_tags = &tags ++ let &tags = tagsfile ++ ++ new ++ call ccomplete#Complete(1, '') ++ call ccomplete#Complete(0, 'myvar.x') ++ ++ call assert_false(exists('g:ccomplete_injected'), ++ \ 'typeref field was executed as an Ex command during omni-completion') ++ ++ bwipe! ++ let &tags = save_tags ++ unlet! g:ccomplete_injected ++endfunc ++ ++" A legitimate typeref must still drive struct-member completion: escaping the ++" field value must not break the normal path. ++func Test_ccomplete_typeref_completion_still_works() ++ let tagsfile = s:WriteTags([ ++ \ "myvar\tmain.c\t/^x$/;\"\tv\ttyperef:struct:mystruct", ++ \ "alpha\tmain.c\t/^x$/;\"\tm\tstruct:mystruct", ++ \ "beta\tmain.c\t/^x$/;\"\tm\tstruct:mystruct", ++ \ ]) ++ ++ let save_tags = &tags ++ let &tags = tagsfile ++ ++ new ++ call ccomplete#Complete(1, '') ++ let items = ccomplete#Complete(0, 'myvar.') ++ ++ call assert_equal(type([]), type(items), ++ \ 'ccomplete#Complete did not return a list') ++ let names = map(copy(items), 'v:val.word') ++ call assert_true(index(names, 'alpha') >= 0, ++ \ 'struct member "alpha" missing from completion: ' . string(names)) ++ call assert_true(index(names, 'beta') >= 0, ++ \ 'struct member "beta" missing from completion: ' . string(names)) ++ ++ bwipe! ++ let &tags = save_tags ++endfunc ++ ++" vim: shiftwidth=2 sts=2 expandtab +-- +2.44.4 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index a484a5c840..6ef9745b57 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -48,6 +48,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \ file://CVE-2026-57455.patch \ file://CVE-2026-59856.patch \ file://CVE-2026-59857.patch \ + file://CVE-2026-59858.patch \ " PV .= ".1683"