SUSE-SU-2026:21833-1

See a problem?
Please try reporting it to the source first.

Source

Import Source

JSON Data

https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:21833-1

Upstream

CVE (6)

Related

CVE (6)

Published

2026-05-28T12:10:45Z

Modified

2026-07-09T18:24:23Z

Summary

Security update for vim

Details

This update for vim fixes the following issues

CVE-2026-39881: command injection in NetBeans interface can lead to arbitrary file reads and writes (bsc#1261833).
CVE-2026-42307: Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim (bsc#1264706).
CVE-2026-43961: Vimscript Code Injection in netrw NetrwMarkFile() via crafted filename (bsc#1265349).
CVE-2026-44656: Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's: find command-line completion (bsc#1264707).
CVE-2026-45130: Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active (bsc#1264708).
CVE-2026-46483: command injection via tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems (bsc#1265360).

Changes for vim:

Update to v9.2.0530.
Fix for incorrectly detecting scientific parameter files as bitbake recipies. (bsc#1262395)

References

Affected packages

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.2.0530-160000.1.1

{
    "binaries":  [
        {
            "vim":  "9.2.0530-160000.1.1",
            "xxd":  "9.2.0530-160000.1.1"
        }
    ]
}

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:21833-1.json"