vim (2:8.2.3995-1ubuntu2.24) jammy-security; urgency=medium
* SECURITY UPDATE: Use after free when redirecting display command to
register.
- debian/patches/CVE-2025-26603.patch: Change redir_reg check to use
vim_strchr command check in ./src/register.c.
- CVE-2025-26603
-- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com> Wed, 02 Apr 2025 10:09:01 -0230
vim (2:8.2.3995-1ubuntu2.23) jammy-security; urgency=medium
* SECURITY UPDATE: Denial of service
- debian/patches/CVE-2025-24014.patch: fix a segfault in win_line()
in files src/gui.c, src/testdir/crash/ex_redraw_crash,
src/testdir/test_crash.vim.
- CVE-2025-24014
-- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com> Mon, 03 Feb 2025 08:54:38 -0300
vim (2:8.2.3995-1ubuntu2.22) jammy-security; urgency=medium
* SECURITY UPDATE: Heap-buffer-overflow when switching buffers.
- debian/patches/CVE-2025-22134.patch: Add reset_VIsual_and_resel() to
src/arglist.c. Add ptrlen checks in src/misc1.c and src/ops.c.
- CVE-2025-22134
-- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com> Fri, 17 Jan 2025 12:55:02 -0330
vim (2:8.2.3995-1ubuntu2.21) jammy-security; urgency=medium
* SECURITY UPDATE: Use after free when closing a buffer.
- debian/patches/CVE-2024-47814.patch: Add buf_locked() in src/buffer.c.
Abort autocommands editing a file when buf_locked() in src/ex_cmds.c.
Add buf_locked() in src/proto/buffer.pro.
- CVE-2024-47814
-- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com> Thu, 07 Nov 2024 09:47:21 -0330
vim (2:8.2.3995-1ubuntu2.20) jammy; urgency=medium
* Ensure Ubuntu codenames are current (LP: #2084706).
-- Simon Quigley <tsimonq2@ubuntu.com> Wed, 16 Oct 2024 12:27:14 -0500
vim (2:8.2.3995-1ubuntu2.19) jammy-security; urgency=medium
* SECURITY UPDATE: buffer overflow
- debian/patches/CVE-2024-43802.patch: check buflen before advancing
offset.
- CVE-2024-43802
-- Vyom Yadav <vyom.yadav@canonical.com> Wed, 25 Sep 2024 11:00:01 +0530
vim (2:8.2.3995-1ubuntu2.18) jammy-security; urgency=medium
* SECURITY UPDATE: use after free
- debian/patches/CVE-2024-41957.patch: set tagname to NULL
after being freed
- CVE-2024-41957
* SECURITY UPDATE: use after free
- debian/patches/CVE-2024-43374.patch: add lock to keep
reference valid
- CVE-2024-43374
-- Bruce Cable <bruce.cable@canonical.com> Tue, 27 Aug 2024 15:34:22 +1000
vim (2:8.2.3995-1ubuntu2.17) jammy; urgency=medium
* Ensure Ubuntu codenames are current (LP: #2064687).
-- Simon Quigley <tsimonq2@ubuntu.com> Thu, 02 May 2024 21:37:51 -0500
vim (2:8.2.3995-1ubuntu2.16) jammy-security; urgency=medium
* SECURITY UPDATE: stack based buffer overflow
- debian/patches/CVE-2024-22667.patch: passes error buffer length down
through option callback functions.
- debian/patches/remove-flaky-matchfuzzy-test.patch: removing flaky test
initially introduced in d/p/CVE-2023-2426.patch due to long run time
causing the test and builds to fail.
- CVE-2024-22667
-- Ian Constantin <ian.constantin@canonical.com> Thu, 14 Mar 2024 11:05:11 +0200
vim (2:8.2.3995-1ubuntu2.15) jammy-security; urgency=medium
* SECURITY UPDATE: NULL pointer dereference
- debian/patches/CVE-2022-1725.patch: Check for regexp program becoming NULL
in more places.
- CVE-2022-1725
* SECURITY UPDATE: denial of service
- debian/patches/CVE-2022-1771.patch: Limit recursion of getcmdline().
- CVE-2022-1771
* SECURITY UPDATE: heap based buffer overflow vulnerability
- debian/patches/CVE-2022-1886.patch: Check the length is more than zero.
- CVE-2022-1886
* SECURITY UPDATE: out of bounds write vulnerability
- debian/patches/CVE-2022-1897.patch: Disallow undo when in a substitute
command.
- CVE-2022-1897
* SECURITY UPDATE: out-of-bounds write
- debian/patches/CVE-2022-2000.patch: addresses the potential for an
overflow by adding a bounds check and truncating the message if needed.
- CVE-2022-2000
* SECURITY UPDATE: use-after-free vulnerability
- debian/patches/CVE-2022-2042.patch: Initialize "attr". Check for empty
line early.
- CVE-2022-2042
* SECURITY UPDATE: use-after-free vulnerability
- debian/patches/CVE-2023-46246.patch: Check that the return value from the
vim_str2nr() function is not larger than INT_MAX and if yes, bail out with
an error.
- CVE-2023-46246
* SECURITY UPDATE: use-after-free vulnerability
- debian/patches/CVE-2023-48231.patch: If the current window structure is
no longer valid, fail and return before attempting to set win->w_closing
variable.
- CVE-2023-48231
* SECURITY UPDATE: integer overflow
- debian/patches/CVE-2023-48233.patch: If the count after the :s command is
larger than what fits into a (signed) long variable, abort with
e_value_too_large.
- CVE-2023-48233
* SECURITY UPDATE: integer overflow
- debian/patches/CVE-2023-48234.patch: When getting the count for a normal z
command, it may overflow for large counts given. So verify, that we can
safely store the result in a long.
- CVE-2023-48234
* SECURITY UPDATE: integer overflow
- debian/patches/CVE-2023-48235.patch: When parsing relative ex addresses
one may unintentionally cause an overflow (because LONG_MAX - lnum will
overflow for negative addresses).
- CVE-2023-48235
* SECURITY UPDATE: integer overflow
- debian/patches/CVE-2023-48236.patch: When using the z= command, we may
overflow the count with values larger than MAX_INT. So verify that we do
not overflow and in case when an overflow is detected, simply return 0.
- CVE-2023-48236
* SECURITY UPDATE: integer overflow
- debian/patches/CVE-2023-48237.patch: When shifting lines in operator
pending mode and using a very large value, we may overflow the size of
integer. Fix this by using a long variable, testing if the result would
be larger than INT_MAX and if so, indent by INT_MAX value.
- CVE-2023-48237
* SECURITY UPDATE: use-after-free vulnerability
- debian/patches/CVE-2023-48706.patch: ensure that the sub var always using
allocated memory.
- CVE-2023-48706
-- Fabian Toepfer <fabian.toepfer@canonical.com> Tue, 05 Dec 2023 18:58:57 +0100
# For older changelog entries, run 'apt-get changelog vim-doc'
Generated by dwww version 1.14 on Sun Aug 10 04:15:09 CEST 2025.