[CLSA-2026:1789136288] Fix CVE(s): CVE-2026-73073
Type:
security
Severity:
Important
Release date:
2026-09-11 14:18:18 UTC
Description:
* SECURITY UPDATE: Arbitrary Ex command execution during C omni-completion: s:StructMembers() in runtime/autoload/ccomplete.vim interpolates a tags-file typeref/typename value into a :vimgrep pattern with only "/" and "\" escaped, so an unclosed "[" makes vimgrep pattern skipping fail and a following "|" is then parsed as an Ex command separator, running the rest of the tag value as Ex commands - debian/patches/CVE-2026-73073.patch: match the typename literally in s:StructMembers() by prefixing it with "\V" and restoring magic mode with "\m" for the trailing "\(\t\|$\)" group, so no regex metacharacter in the tag field can affect :vimgrep pattern parsing; this completes CVE-2026-59858.patch (upstream 9.2.0735), whose escaping alone was insufficient; the upstream src/version.c bump and the new src/testdir/test_plugin_ccomplete.vim test are omitted as they do not apply to 8.1.0875 - CVE-2026-73073
CVEs fixed:
Updated packages:
  • vim_8.1.0875-5+deb10u6+tuxcare.els28_amd64.deb
    sha:6e28ba489070edee9447fd05e64558040775ff4c
  • vim-athena_8.1.0875-5+deb10u6+tuxcare.els28_amd64.deb
    sha:500aedaa3c038bd642650ea87c24e2ef23e4b76e
  • vim-common_8.1.0875-5+deb10u6+tuxcare.els28_all.deb
    sha:9b30e40d3e71a4f858cc8236edfac64c655a91a9
  • vim-doc_8.1.0875-5+deb10u6+tuxcare.els28_all.deb
    sha:7011266954c536725583c981220c069946564a71
  • vim-gtk_8.1.0875-5+deb10u6+tuxcare.els28_amd64.deb
    sha:a2b65cdae947895575e938549c891254793cefcf
  • vim-gtk3_8.1.0875-5+deb10u6+tuxcare.els28_amd64.deb
    sha:67bec7f27b3a2474b6bcec4d6441763c0d304c75
  • vim-gui-common_8.1.0875-5+deb10u6+tuxcare.els28_all.deb
    sha:3dba8858a90aaed74643590e185fa76a5049bc43
  • vim-nox_8.1.0875-5+deb10u6+tuxcare.els28_amd64.deb
    sha:5934f561a040c08cdf2624ecaaca8392c81fe505
  • vim-runtime_8.1.0875-5+deb10u6+tuxcare.els28_all.deb
    sha:179c437b90dbf05553457df23e750ccfc13f9fa2
  • vim-tiny_8.1.0875-5+deb10u6+tuxcare.els28_amd64.deb
    sha:ae4031640fe020c9d1a78acfa03debf82437f27d
  • xxd_8.1.0875-5+deb10u6+tuxcare.els28_amd64.deb
    sha:b276942c9cce2bf39e314a2b09b5e83df3b49e9a
  • vim_8.1.0875-5+deb10u6+tuxcare.els28_arm64.deb
    sha:5c3f3871e1fac0391e4412fa31c8653fad9929e8
  • vim-athena_8.1.0875-5+deb10u6+tuxcare.els28_arm64.deb
    sha:3c11c25537eec483acd5d701834a2423c0bbe58c
  • vim-gtk_8.1.0875-5+deb10u6+tuxcare.els28_arm64.deb
    sha:6a90c1747f49f594a8e01c60f215784545889acd
  • vim-gtk3_8.1.0875-5+deb10u6+tuxcare.els28_arm64.deb
    sha:01ea7795c0330bbad74acb6bafe62b8a27d2c8a9
  • vim-nox_8.1.0875-5+deb10u6+tuxcare.els28_arm64.deb
    sha:a4b5d4deb9ba81cf5fda1f869d43097ec2fa8518
  • vim-tiny_8.1.0875-5+deb10u6+tuxcare.els28_arm64.deb
    sha:e7140610ae7eba3af4c80fca9aef1b05248b1bb5
  • xxd_8.1.0875-5+deb10u6+tuxcare.els28_arm64.deb
    sha:e0466783c0464fe4fb756ebfd1c315ba50e34079
  • vim_8.1.0875-5+deb10u6+tuxcare.els28_armel.deb
    sha:fd93b1be6b56f4f355c34771f74d63637a556d11
  • vim-athena_8.1.0875-5+deb10u6+tuxcare.els28_armel.deb
    sha:4322d11f33efb337a6628bd6804e967397f13de8
  • vim-gtk_8.1.0875-5+deb10u6+tuxcare.els28_armel.deb
    sha:8b02c00329384768a4a0095aef919b3bb7c94f84
  • vim-gtk3_8.1.0875-5+deb10u6+tuxcare.els28_armel.deb
    sha:b6344190b679b2b8502926dcd19b5e09bc9ca8e8
  • vim-nox_8.1.0875-5+deb10u6+tuxcare.els28_armel.deb
    sha:de34761774d286f979c2ea0161348175a10cea63
  • vim-tiny_8.1.0875-5+deb10u6+tuxcare.els28_armel.deb
    sha:4e998b4320b3c5156889ff94a2c8c2e1cb5e4bb9
  • xxd_8.1.0875-5+deb10u6+tuxcare.els28_armel.deb
    sha:86f419d97cef6814e97c818990a60ef4c6ba91ff
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.