* SECURITY UPDATE: crash when clearing the argument list while using it - debian/patches/CVE-2021-4166.patch: lock the argument list for ":all"; matches upstream patch 8.2.3884. - CVE-2021-4166 * SECURITY UPDATE: reading past end of completion with a long line - debian/patches/CVE-2022-2343.patch: build the inferred-case text in a growarray when it outgrows IObuff; matches upstream patch 9.0.0045. - CVE-2022-2343 * SECURITY UPDATE: memory access errors when calling setloclist() in an autocommand - debian/patches/CVE-2022-3016.patch: give an error if the list was changed unexpectedly and drop the stale pointer instead of storing it back; matches upstream patches 8.2.1677 and 9.0.0286. - CVE-2022-3016 * SECURITY UPDATE: SpellFileMissing autocmd may delete buffer - debian/patches/CVE-2022-3352.patch: disallow deleting the current buffer while loading a spell file; matches upstream patch 9.0.0614. - CVE-2022-3352 * SECURITY UPDATE: filetype autocmd may cause freed memory access - debian/patches/CVE-2022-3705.patch: set the quickfix-busy flag while filling the buffer; matches upstream patch 9.0.0805. - CVE-2022-3705 * SECURITY UPDATE: invalid memory access in substitute with function - debian/patches/CVE-2022-4141.patch: check for text or buffer being locked before jumping to a file; matches upstream patch 9.0.0947. - CVE-2022-4141