{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for vim is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Vim (Vi IMproved) is an updated and improved version of the vi editor.\n\nSecurity Fix(es):\n\n* vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)\n\n* vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177)\n\n* vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411)\n\n* vim: command injection when decompressing .tgz archives (CVE-2026-46483)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2026:34476", "url": "https://access.redhat.com/errata/RHSA-2026:34476" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2455400", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455400" }, { "category": "external", "summary": "2455542", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455542" }, { "category": "external", "summary": "2461614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461614" }, { "category": "external", "summary": "2477915", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477915" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34476.json" } ], "title": "Red Hat Security Advisory: vim security update", "tracking": { "current_release_date": "2026-08-09T00:27:22+00:00", "generator": { "date": "2026-08-09T00:27:22+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.3.12" } }, "id": "RHSA-2026:34476", "initial_release_date": "2026-07-01T19:58:39+00:00", "revision_history": [ { "date": "2026-07-01T19:58:39+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-07-01T19:58:39+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2026-08-09T00:27:22+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product": { "name": "Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_e4s:8.8::appstream" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux BaseOS E4S (v.8.8)", "product": { "name": "Red Hat Enterprise Linux BaseOS E4S (v.8.8)", "product_id": "BaseOS-8.8.0.Z.E4S", "product_identification_helper": { "cpe": "cpe:/o:redhat:rhel_e4s:8.8::baseos" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product": { "name": "Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_tus:8.8::appstream" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux BaseOS TUS (v.8.8)", "product": { "name": "Red Hat Enterprise Linux BaseOS TUS (v.8.8)", "product_id": "BaseOS-8.8.0.Z.TUS", "product_identification_helper": { "cpe": "cpe:/o:redhat:rhel_tus:8.8::baseos" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "vim-2:8.0.1763-20.el8_8.2.src", "product": { "name": "vim-2:8.0.1763-20.el8_8.2.src", "product_id": "vim-2:8.0.1763-20.el8_8.2.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim@8.0.1763-20.el8_8.2?arch=src&epoch=2" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le", "product": { "name": "vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le", "product_id": "vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-minimal@8.0.1763-20.el8_8.2?arch=ppc64le&epoch=2" } } }, { "category": "product_version", "name": "vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "product": { "name": "vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "product_id": "vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-debugsource@8.0.1763-20.el8_8.2?arch=ppc64le&epoch=2" } } }, { "category": "product_version", "name": "vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "product": { "name": "vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "product_id": "vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-X11-debuginfo@8.0.1763-20.el8_8.2?arch=ppc64le&epoch=2" } } }, { "category": "product_version", "name": "vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "product": { "name": "vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "product_id": "vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-common-debuginfo@8.0.1763-20.el8_8.2?arch=ppc64le&epoch=2" } } }, { "category": "product_version", "name": "vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "product": { "name": "vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "product_id": "vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-debuginfo@8.0.1763-20.el8_8.2?arch=ppc64le&epoch=2" } } }, { "category": "product_version", "name": "vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "product": { "name": "vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "product_id": "vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-enhanced-debuginfo@8.0.1763-20.el8_8.2?arch=ppc64le&epoch=2" } } }, { "category": "product_version", "name": "vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "product": { "name": "vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "product_id": "vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-minimal-debuginfo@8.0.1763-20.el8_8.2?arch=ppc64le&epoch=2" } } }, { "category": "product_version", "name": "vim-X11-2:8.0.1763-20.el8_8.2.ppc64le", "product": { "name": "vim-X11-2:8.0.1763-20.el8_8.2.ppc64le", "product_id": "vim-X11-2:8.0.1763-20.el8_8.2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-X11@8.0.1763-20.el8_8.2?arch=ppc64le&epoch=2" } } }, { "category": "product_version", "name": "vim-common-2:8.0.1763-20.el8_8.2.ppc64le", "product": { "name": "vim-common-2:8.0.1763-20.el8_8.2.ppc64le", "product_id": "vim-common-2:8.0.1763-20.el8_8.2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-common@8.0.1763-20.el8_8.2?arch=ppc64le&epoch=2" } } }, { "category": "product_version", "name": "vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le", "product": { "name": "vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le", "product_id": "vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-enhanced@8.0.1763-20.el8_8.2?arch=ppc64le&epoch=2" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "product": { "name": "vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "product_id": "vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-minimal@8.0.1763-20.el8_8.2?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "product": { "name": "vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "product_id": "vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-debugsource@8.0.1763-20.el8_8.2?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "product": { "name": "vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "product_id": "vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-X11-debuginfo@8.0.1763-20.el8_8.2?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "product": { "name": "vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "product_id": "vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-common-debuginfo@8.0.1763-20.el8_8.2?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "product": { "name": "vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "product_id": "vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-debuginfo@8.0.1763-20.el8_8.2?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "product": { "name": "vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "product_id": "vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-enhanced-debuginfo@8.0.1763-20.el8_8.2?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "product": { "name": "vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "product_id": "vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-minimal-debuginfo@8.0.1763-20.el8_8.2?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "product": { "name": "vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "product_id": "vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-X11@8.0.1763-20.el8_8.2?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "vim-common-2:8.0.1763-20.el8_8.2.x86_64", "product": { "name": "vim-common-2:8.0.1763-20.el8_8.2.x86_64", "product_id": "vim-common-2:8.0.1763-20.el8_8.2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-common@8.0.1763-20.el8_8.2?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "product": { "name": "vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "product_id": "vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-enhanced@8.0.1763-20.el8_8.2?arch=x86_64&epoch=2" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "product": { "name": "vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "product_id": "vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/vim-filesystem@8.0.1763-20.el8_8.2?arch=noarch&epoch=2" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "vim-X11-2:8.0.1763-20.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.ppc64le" }, "product_reference": "vim-X11-2:8.0.1763-20.el8_8.2.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-X11-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le" }, "product_reference": "vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-common-2:8.0.1763-20.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.ppc64le" }, "product_reference": "vim-common-2:8.0.1763-20.el8_8.2.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-common-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-common-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le" }, "product_reference": "vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le" }, "product_reference": "vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le" }, "product_reference": "vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le" }, "product_reference": "vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le" }, "product_reference": "vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-filesystem-2:8.0.1763-20.el8_8.2.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch" }, "product_reference": "vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le" }, "product_reference": "vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)", "product_id": "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-X11-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:vim-X11-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "vim-common-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:vim-common-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-common-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "vim-filesystem-2:8.0.1763-20.el8_8.2.noarch as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch" }, "product_reference": "vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "vim-2:8.0.1763-20.el8_8.2.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)", "product_id": "BaseOS-8.8.0.Z.E4S:vim-2:8.0.1763-20.el8_8.2.src" }, "product_reference": "vim-2:8.0.1763-20.el8_8.2.src", "relates_to_product_reference": "BaseOS-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)", "product_id": "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le" }, "product_reference": "vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "relates_to_product_reference": "BaseOS-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)", "product_id": "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "BaseOS-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)", "product_id": "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le" }, "product_reference": "vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "relates_to_product_reference": "BaseOS-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)", "product_id": "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "BaseOS-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)", "product_id": "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le" }, "product_reference": "vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "relates_to_product_reference": "BaseOS-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)", "product_id": "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "BaseOS-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)", "product_id": "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le" }, "product_reference": "vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "relates_to_product_reference": "BaseOS-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)", "product_id": "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "BaseOS-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)", "product_id": "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le" }, "product_reference": "vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "relates_to_product_reference": "BaseOS-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)", "product_id": "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "BaseOS-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)", "product_id": "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le" }, "product_reference": "vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le", "relates_to_product_reference": "BaseOS-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-minimal-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)", "product_id": "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "BaseOS-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)", "product_id": "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le" }, "product_reference": "vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "relates_to_product_reference": "BaseOS-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8)", "product_id": "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "BaseOS-8.8.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "vim-2:8.0.1763-20.el8_8.2.src as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)", "product_id": "BaseOS-8.8.0.Z.TUS:vim-2:8.0.1763-20.el8_8.2.src" }, "product_reference": "vim-2:8.0.1763-20.el8_8.2.src", "relates_to_product_reference": "BaseOS-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)", "product_id": "BaseOS-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "BaseOS-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)", "product_id": "BaseOS-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "BaseOS-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)", "product_id": "BaseOS-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "BaseOS-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)", "product_id": "BaseOS-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "BaseOS-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)", "product_id": "BaseOS-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "BaseOS-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "vim-minimal-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)", "product_id": "BaseOS-8.8.0.Z.TUS:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "BaseOS-8.8.0.Z.TUS" }, { "category": "default_component_of", "full_product_name": { "name": "vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8)", "product_id": "BaseOS-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" }, "product_reference": "vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "relates_to_product_reference": "BaseOS-8.8.0.Z.TUS" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-34982", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "discovery_date": "2026-04-06T16:02:10.004743+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2455400" } ], "notes": [ { "category": "description", "text": "A flaw was found in Vim. A modeline is used to set specific editor options directly from a text file. However, the `complete`, `guitabtooltip`, `printheader` options and the `mapset` function lack proper security checks, allowing an attacker to bypass restrictions and cause arbitrary OS command execution.", "title": "Vulnerability description" }, { "category": "summary", "text": "vim: arbitrary command execution via modeline sandbox bypass", "title": "Vulnerability summary" }, { "category": "other", "text": "To exploit this vulnerability, an attacker needs to convince a user to open a specially crafted file. The arbitrary OS command execution is restricted to the privileges of the user running Vim, limiting the potential of a full system compromise.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-34982" }, { "category": "external", "summary": "RHBZ#2455400", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455400" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34982", "url": "https://www.cve.org/CVERecord?id=CVE-2026-34982" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34982", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34982" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/04/01/1", "url": "http://www.openwall.com/lists/oss-security/2026/04/01/1" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615", "url": "https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615" }, { "category": "external", "summary": "https://github.com/vim/vim/releases/tag/v9.2.0276", "url": "https://github.com/vim/vim/releases/tag/v9.2.0276" }, { "category": "external", "summary": "https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9", "url": "https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9" } ], "release_date": "2026-04-06T15:16:48.809000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-07-01T19:58:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:34476" }, { "category": "workaround", "details": "To mitigate this issue, disable the modeline support by adding the following command to the Vim configuration file:\n\n~~~\nset nomodeline\n~~~", "product_ids": [ "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "vim: arbitrary command execution via modeline sandbox bypass" }, { "cve": "CVE-2026-35177", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "discovery_date": "2026-04-06T19:01:00.182513+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2455542" } ], "notes": [ { "category": "description", "text": "A flaw was found in Vim's zip.vim plugin. A local user could be tricked into opening a specially crafted zip archive, which would allow a path traversal bypass. This vulnerability enables an attacker to overwrite arbitrary files on the system, potentially leading to data integrity issues or further system compromise.", "title": "Vulnerability description" }, { "category": "summary", "text": "vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass", "title": "Vulnerability summary" }, { "category": "other", "text": "There's a flaw in `zip.vim` plugin in Vim, allowing a local attacker to overwrite arbitrary files. A user must be tricked into opening a specially crafted zip archive for exploitation, potentially compromising data integrity or the system. When successfully exploited this vulnerability enables the attacker to overwrite arbitrary files or inject code in sensitive system's location, the impact of the exploitation depends on the privileges which the `vim` process is being executed. Sensitive or privileges files are only susceptible to be overwritten only if the `vim` process is being executed by a high privileged user.\n\nRed Hat Product Security team has rated this vulnerability as having a impact of MODERATE, this decision was made by the fact the user needs to be tricked to open a maliciously crafted file in order to a successful attack to be performed. Additionally the impact will be limited to files which the user running the `vim` process has write permissions.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-35177" }, { "category": "external", "summary": "RHBZ#2455542", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455542" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-35177", "url": "https://www.cve.org/CVERecord?id=CVE-2026-35177" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35177", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35177" }, { "category": "external", "summary": "https://github.com/vim/vim/security/advisories/GHSA-jc86-w7vm-8p24", "url": "https://github.com/vim/vim/security/advisories/GHSA-jc86-w7vm-8p24" } ], "release_date": "2026-04-06T17:54:42.779000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-07-01T19:58:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:34476" }, { "category": "workaround", "details": "Avoid opening untrusted zip archives with Vim. This operational control prevents the necessary user interaction required to trigger the path traversal vulnerability in the `zip.vim` plugin.", "product_ids": [ "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass" }, { "cve": "CVE-2026-41411", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "discovery_date": "2026-04-24T18:01:49.275019+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2461614" } ], "notes": [ { "category": "description", "text": "A flaw was found in Vim, an open-source command-line text editor. This command injection vulnerability occurs during tag file processing. A local user could craft a malicious tags file containing backtick syntax in the filename field. When Vim resolves a tag from this file, it executes the embedded command via the system shell, leading to arbitrary code execution with the privileges of the running user.", "title": "Vulnerability description" }, { "category": "summary", "text": "vim: Vim: Command injection allows arbitrary code execution via malicious tag files", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-41411" }, { "category": "external", "summary": "RHBZ#2461614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461614" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41411", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41411" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41411", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41411" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb", "url": "https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb" }, { "category": "external", "summary": "https://github.com/vim/vim/releases/tag/v9.2.0357", "url": "https://github.com/vim/vim/releases/tag/v9.2.0357" }, { "category": "external", "summary": "https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8", "url": "https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8" } ], "release_date": "2026-04-24T16:51:39.657000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-07-01T19:58:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:34476" }, { "category": "workaround", "details": "Mitigation for this issue involves exercising caution when opening or processing tag files from untrusted sources. Users should avoid loading tag files from unknown or suspicious origins to prevent the execution of arbitrary commands.", "product_ids": [ "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "vim: Vim: Command injection allows arbitrary code execution via malicious tag files" }, { "cve": "CVE-2026-46483", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "discovery_date": "2026-05-15T16:00:58.827425+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2477915" } ], "notes": [ { "category": "description", "text": "A flaw was found in Vim. When decompressing .tgz archives, the Vimuntar function builds shell commands using shellescape() without the {special} flag. This allows a specially crafted archive filename to trigger Vim cmdline-special expansion and execute arbitrary commands in the context of the current user.", "title": "Vulnerability description" }, { "category": "summary", "text": "vim: command injection when decompressing .tgz archives", "title": "Vulnerability summary" }, { "category": "other", "text": "To exploit this issue, an attacker needs to convince a user to decompress a .tgz archive with a specially crafted filename. Additionally, possible arbitrary command execution is restricted to the context of the user running Vim. These conditions limit the exposure of this vulnerability and the potential of a full system compromise. Due to these reasons, this flaw has been rated with a moderate severity.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-46483" }, { "category": "external", "summary": "RHBZ#2477915", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477915" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-46483", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46483" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46483", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46483" }, { "category": "external", "summary": "https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1", "url": "https://github.com/vim/vim/commit/3fb5e58fbc63d86a3e65f1a141b0d67af2aa38a1" }, { "category": "external", "summary": "https://github.com/vim/vim/releases/tag/v9.2.0479", "url": "https://github.com/vim/vim/releases/tag/v9.2.0479" }, { "category": "external", "summary": "https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w", "url": "https://github.com/vim/vim/security/advisories/GHSA-2fpv-9ff7-xg5w" } ], "release_date": "2026-05-15T14:57:31.872000+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-07-01T19:58:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:34476" }, { "category": "workaround", "details": "To mitigate this vulnerability, do not decompress untrusted .tgz archives with the Vimuntar command. Use 'tar -x -z -f' directly, instead.", "product_ids": [ "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.E4S:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "AppStream-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "AppStream-8.8.0.Z.TUS:vim-filesystem-2:8.0.1763-20.el8_8.2.noarch", "AppStream-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.ppc64le", "BaseOS-8.8.0.Z.E4S:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-2:8.0.1763-20.el8_8.2.src", "BaseOS-8.8.0.Z.TUS:vim-X11-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-common-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-debugsource-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-enhanced-debuginfo-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-2:8.0.1763-20.el8_8.2.x86_64", "BaseOS-8.8.0.Z.TUS:vim-minimal-debuginfo-2:8.0.1763-20.el8_8.2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "vim: command injection when decompressing .tgz archives" } ] }