[CLSA-2026:1791243820] Fix of 22 CVEs

Type:

security

Severity:

Important

Release date:

2026-10-05 23:44:07 UTC

Description:

   * SECURITY UPDATE: invalid memory access when scrolling without valid screen
     - debian/patches/CVE-2021-3903.patch: invalid memory access when scrolling without valid screen
     - CVE-2021-3903
   * SECURITY UPDATE: reading character past end of line
     - debian/patches/CVE-2021-3927.patch: reading character past end of line
     - CVE-2021-3927
   * SECURITY UPDATE: crash when using CTRL-W f without finding a file name
     - debian/patches/CVE-2021-3973.patch: crash when using CTRL-W f without finding a file name
     - CVE-2021-3973
   * SECURITY UPDATE: illegal memory access when C-indenting
     - debian/patches/CVE-2021-3984.patch: illegal memory access when C-indenting
     - CVE-2021-3984
   * SECURITY UPDATE: using freed memory in open command
     - debian/patches/CVE-2021-4069.patch: using freed memory in open command
     - CVE-2021-4069
   * SECURITY UPDATE: illegal memory access when using a lambda with an error
     - debian/patches/CVE-2021-4136.patch: illegal memory access when using a lambda with an error
     - CVE-2021-4136
   * SECURITY UPDATE: crash when clearing the argument list while using it
     - debian/patches/CVE-2021-4166.patch: crash when clearing the argument list while using it
     - CVE-2021-4166
   * SECURITY UPDATE: using freed memory with /\%V
     - debian/patches/CVE-2021-4192.patch: using freed memory with /\%V
     - CVE-2021-4192
   * SECURITY UPDATE: stack corruption when looking for spell suggestions
     - debian/patches/CVE-2022-0408.patch: stack corruption when looking for spell suggestions
     - CVE-2022-0408
   * SECURITY UPDATE: using freed memory when substitute with function call
     - debian/patches/CVE-2022-0413.patch: using freed memory when substitute with function call
     - CVE-2022-0413
   * SECURITY UPDATE: using freed memory with :lopen and :bwipe
     - debian/patches/CVE-2022-0443.patch: using freed memory with :lopen and :bwipe
     - CVE-2022-0443
   * SECURITY UPDATE: may end up with no current buffer
     - debian/patches/CVE-2022-0554.patch: may end up with no current buffer
     - CVE-2022-0554
   * SECURITY UPDATE: crash when using many composing characters in error message
     - debian/patches/CVE-2022-0629.patch: crash when using many composing characters in error message
     - CVE-2022-0629
   * SECURITY UPDATE: crash when using special multi-byte character
     - debian/patches/CVE-2022-0685.patch: crash when using special multi-byte character
     - CVE-2022-0685
   * SECURITY UPDATE: crash with specific regexp pattern and string
     - debian/patches/CVE-2022-0729.patch: crash with specific regexp pattern and string
     - CVE-2022-0729
   * SECURITY UPDATE: using buffer line after it has been freed
     - debian/patches/CVE-2022-1154.patch: using buffer line after it has been freed
     - CVE-2022-1154
   * SECURITY UPDATE: NULL pointer access when using invalid pattern
     - debian/patches/CVE-2022-1620.patch: NULL pointer access when using invalid pattern
     - CVE-2022-1620
   * SECURITY UPDATE: reading past end of line with "gf" in Visual block mode
     - debian/patches/CVE-2022-1720.patch: reading past end of line with "gf" in Visual block mode
     - CVE-2022-1720
   * SECURITY UPDATE: reading past end of the line when C-indenting
     - debian/patches/CVE-2022-1733.patch: reading past end of the line when C-indenting
     - CVE-2022-1733
   * SECURITY UPDATE: accessing freed memory when line is flushed
     - debian/patches/CVE-2022-1796.patch: accessing freed memory when line is flushed
     - CVE-2022-1796
   * SECURITY UPDATE: after text formatting cursor may be in an invalid position
     - debian/patches/CVE-2022-1851.patch: after text formatting cursor may be in an invalid position
     - CVE-2022-1851
   * SECURITY UPDATE: cursor position may be invalid after "0;" range
     - debian/patches/CVE-2022-1927.patch: cursor position may be invalid after "0;" range
     - CVE-2022-1927
   * Fix the tests that fail on this branch
     - debian/patches/fix-Test_arglist_autocmd.patch: adjust
       Test_arglist_autocmd() for locking the argument list during ":all",
       per upstream patch 8.2.3885, the test-side companion to 8.2.3884
       (CVE-2021-4166)
     - debian/patches/fix-Test_matchfuzzy.patch: strip the directory from the
       buffer names before fuzzy-matching, per upstream patch 9.0.0030, so
       the test no longer depends on the build directory's name

CVEs fixed:

Updated packages:

vim_8.2.2434-3+deb11u3+tuxcare.els15_amd64.deb
sha:56f93616014c7b100e6d9d96aad4c7c5ecc5de40
vim-athena_8.2.2434-3+deb11u3+tuxcare.els15_amd64.deb
sha:4538ba7ebccbce4150a2f59d961b2b3555857354
vim-common_8.2.2434-3+deb11u3+tuxcare.els15_all.deb
sha:5353d40ca2da7004fd4fecbf77582a5430206284
vim-doc_8.2.2434-3+deb11u3+tuxcare.els15_all.deb
sha:0163de932d8574ac34c832b70dcfb166ec9b92e0
vim-gtk_8.2.2434-3+deb11u3+tuxcare.els15_all.deb
sha:7d642528b4eab5efe398debdedb25f93b6737388
vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els15_amd64.deb
sha:7efedbce023d5843ae6e8153a2de7fbb5d011359
vim-gui-common_8.2.2434-3+deb11u3+tuxcare.els15_all.deb
sha:15446d8b6ccb5d1a3f9e4fb9eeb457518ec0c148
vim-nox_8.2.2434-3+deb11u3+tuxcare.els15_amd64.deb
sha:0a73d91627e4dde30398cd242390aa3657d141e7
vim-runtime_8.2.2434-3+deb11u3+tuxcare.els15_all.deb
sha:f65f0d81494b0df160ea796139a0c37703d692aa
vim-tiny_8.2.2434-3+deb11u3+tuxcare.els15_amd64.deb
sha:ca01d7803ae1c78d739fe880fb78963ea88f475b
xxd_8.2.2434-3+deb11u3+tuxcare.els15_amd64.deb
sha:463cc1e23dbbfe580090d2b78b19b8223a603ec5
vim_8.2.2434-3+deb11u3+tuxcare.els15_arm64.deb
sha:dabd326bdacc7506849c1758c8bc8c0cca7a50e4
vim-athena_8.2.2434-3+deb11u3+tuxcare.els15_arm64.deb
sha:6bdcf930a42eea4f93279ab76d764b8fbcd5fc3b
vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els15_arm64.deb
sha:79765e59fa75a23c41b6cd0b3fcf5c31d0ca83f3
vim-nox_8.2.2434-3+deb11u3+tuxcare.els15_arm64.deb
sha:9a52ff116cd7e1aaa04d854c3a8ea7f09355a3d6
vim-tiny_8.2.2434-3+deb11u3+tuxcare.els15_arm64.deb
sha:d85212e5aca9e8a123e42f98eaf2188912a18758
xxd_8.2.2434-3+deb11u3+tuxcare.els15_arm64.deb
sha:38eda9112a4e2ec2f4bb73a033808f5515f7758a
vim_8.2.2434-3+deb11u3+tuxcare.els15_armel.deb
sha:edaad527d64880d4d17eadcd5b149b427ad608d6
vim-athena_8.2.2434-3+deb11u3+tuxcare.els15_armel.deb
sha:3c934f8e0b788c98c866648d28ddcb87125410d4
vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els15_armel.deb
sha:feb2b66aff5d6bcd28ad27252f49861bfbc13a31
vim-nox_8.2.2434-3+deb11u3+tuxcare.els15_armel.deb
sha:dca57464db9c081d37c57788b66d16b05c5295ac
vim-tiny_8.2.2434-3+deb11u3+tuxcare.els15_armel.deb
sha:66c5823c642e0691f2fc57419c23b179832e6e2d
xxd_8.2.2434-3+deb11u3+tuxcare.els15_armel.deb
sha:1865fb57b99faaab6e49404231512584871abc75

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.