{"id":"CLSA-2026-1777558504","summary":"vim: Fix of 10 CVEs","details":"- CVE-2021-3928: in suggest_trie_walk() only credit a non-word-char\n  boundary with SCORE_NONWORD when preword is non-empty, so spell\n  suggestions do not read uninitialized memory behind preword.\n- CVE-2021-3974: in nfa_regmatch() NFA_MARK / NFA_MARK_GT /\n  NFA_MARK_LT, save reginput - regline and re-fetch regline via\n  reg_getline() after getmark_buf() so use-after-free cannot occur\n  when getmark_buf flushes the current line.\n- CVE-2022-0368: call check_pos(curbuf, &VIsual) at the end of\n  u_undo_end() when Visual mode is active, so an undo that shortens\n  the buffer cannot leave VIsual pointing past end-of-line / end-\n  of-buffer. Adds a check_pos() helper in misc2.c.\n- CVE-2022-0696: in win_new_tabpage() and goto_tabpage_tp(),\n  refuse to switch/create a tabpage while cmdwin_type != 0,\n  emitting e_cmdwin instead of crashing on cmdline-window re-entry.\n- CVE-2022-1629: in find_next_quote(), after advancing past an\n  escape character return -1 if the next byte is NUL so a trailing\n  backslash cannot be read past end-of-line.\n- CVE-2022-1735: call new check_visual_pos() helper from\n  changed_common() (misc1.c) and stop_insert() (edit.c) whenever\n  Visual mode is active so a change that shrinks the buffer cannot\n  leave VIsual pointing past end-of-line / end-of-buffer.\n- CVE-2022-1771: cap getcmdline() recursion at 50 via a static\n  depth counter, emitting E169 \"Command too recursive\" on overflow\n  to prevent crash from self-recursive cmdline input (e.g. the \"=@\"\n  register loop).\n- CVE-2022-1898: in nv_brackets(), copy the identifier under the\n  cursor with vim_strnsave() before calling find_pattern_in_path()\n  for \"]d\"/\"[d\", so that a match in a modified/freed line cannot\n  cause a use-after-free on ptr.\n- CVE-2022-1968: add get_line_and_copy() helper in search.c and\n  use it instead of ml_get() in find_pattern_in_path(), so the\n  regexp cannot leave line pointing into freed buffer memory when\n  a mark invalidates the current line.\n- CVE-2022-2124: in current_quote() (search.c), break out of the\n  selection-scan loop when line[i] is NUL so a changed line does\n  not cause a read past end-of-line while iterating up to col_end.","modified":"2026-05-27T11:18:24.854389347Z","published":"2026-05-05T21:11:17Z","upstream":["CVE-2021-3928","CVE-2021-3974","CVE-2022-0368","CVE-2022-0696","CVE-2022-1629","CVE-2022-1735","CVE-2022-1771","CVE-2022-1898","CVE-2022-1968","CVE-2022-2124"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1777558504.html"}],"affected":[{"package":{"name":"vim-X11","ecosystem":"TuxCare:CentOS:7","purl":"pkg:rpm/tuxcare/vim-X11?distro=centos-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.1.el7_9.tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1777558504.json"}},{"package":{"name":"vim-common","ecosystem":"TuxCare:CentOS:7","purl":"pkg:rpm/tuxcare/vim-common?distro=centos-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.1.el7_9.tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1777558504.json"}},{"package":{"name":"vim-enhanced","ecosystem":"TuxCare:CentOS:7","purl":"pkg:rpm/tuxcare/vim-enhanced?distro=centos-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.1.el7_9.tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1777558504.json"}},{"package":{"name":"vim-filesystem","ecosystem":"TuxCare:CentOS:7","purl":"pkg:rpm/tuxcare/vim-filesystem?distro=centos-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.1.el7_9.tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1777558504.json"}},{"package":{"name":"vim-minimal","ecosystem":"TuxCare:CentOS:7","purl":"pkg:rpm/tuxcare/vim-minimal?distro=centos-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.629-8.0.1.el7_9.tuxcare.els8"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1777558504.json"}}],"schema_version":"1.7.5"}