[CLSA-2026:1788182469] Fix CVE(s): CVE-2026-73073
Type:
security
Severity:
Important
Release date:
2026-08-31 13:21:21 UTC
Description:
* SECURITY UPDATE: arbitrary Ex command execution during C omni-completion: escaping only "/" and "\\" in the typeref/typename tag field was not enough. With no "/" in the payload an unclosed "[" makes :vimgrep's pattern skipping fail, after which the command parser treats a following "|" as a command separator, so a crafted tags entry still runs arbitrary Ex/OS commands when C omni-completion is invoked on a hostile .c file. - debian/patches/CVE-2026-73073.patch: match the type field literally with \V ... \m around escape(typename, '/\') when building the :vimgrep pattern in s:StructMembers(), in runtime/autoload/ccomplete.vim; matches upstream patch 9.2.0845. - CVE-2026-73073
CVEs fixed:
Updated packages:
  • vim_7.4.1689-3ubuntu1.5+tuxcare.els73_amd64.deb
    sha:ab1a65c7daafb1eb0b17c711b296e28f6251b120
  • vim-athena_7.4.1689-3ubuntu1.5+tuxcare.els73_amd64.deb
    sha:cbb4cbbf70df7a2c300253f189e769c2376b0283
  • vim-athena-py2_7.4.1689-3ubuntu1.5+tuxcare.els73_amd64.deb
    sha:311a53fdfaff2c685d7af5ca4cd464191843360c
  • vim-common_7.4.1689-3ubuntu1.5+tuxcare.els73_amd64.deb
    sha:48f0af4644d8519fa373314457abba0d69643741
  • vim-doc_7.4.1689-3ubuntu1.5+tuxcare.els73_all.deb
    sha:45ba809d555ac00fab2dd921a2243468ec54008a
  • vim-gnome_7.4.1689-3ubuntu1.5+tuxcare.els73_amd64.deb
    sha:ff284e1ae2cdb3fabb65b83ff71cc39e79430350
  • vim-gnome-py2_7.4.1689-3ubuntu1.5+tuxcare.els73_amd64.deb
    sha:5be80b647391256d39da79066cc2bdaf67831143
  • vim-gtk_7.4.1689-3ubuntu1.5+tuxcare.els73_amd64.deb
    sha:efbe55246ecd124629914747473db614ff8d577a
  • vim-gtk-py2_7.4.1689-3ubuntu1.5+tuxcare.els73_amd64.deb
    sha:e9e640bd4a0866fd169d537fa4436f98ed24d174
  • vim-gtk3_7.4.1689-3ubuntu1.5+tuxcare.els73_amd64.deb
    sha:25b3b4ce11ef09b94216d72009a5288690292595
  • vim-gtk3-py2_7.4.1689-3ubuntu1.5+tuxcare.els73_amd64.deb
    sha:de4dde3dc478d2d3e3be89953c7deb1d97b597fb
  • vim-gui-common_7.4.1689-3ubuntu1.5+tuxcare.els73_all.deb
    sha:96354f211ac35bef6c49862ab2eb9623d2a96547
  • vim-nox_7.4.1689-3ubuntu1.5+tuxcare.els73_amd64.deb
    sha:79a6faefe5d3d38736e59161e92a7f75b1ce778b
  • vim-nox-py2_7.4.1689-3ubuntu1.5+tuxcare.els73_amd64.deb
    sha:e33ec4cbbcbe140201aa8a56286d71d9f4c82cc5
  • vim-runtime_7.4.1689-3ubuntu1.5+tuxcare.els73_all.deb
    sha:30b658842a4360c7f25659d03b62b5c3d57c666b
  • vim-tiny_7.4.1689-3ubuntu1.5+tuxcare.els73_amd64.deb
    sha:ca49a59e5c3502861d8d33d3f45df5b0f46a430d
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.