[ubuntu/resolute-updates] vim 2:9.1.2141-1ubuntu4.5 (Accepted)

[Ubuntu Archive Robot]

vim (2:9.1.2141-1ubuntu4.5) resolute-security; urgency=medium

  * debian/patches/0005-skip-autocmd-test-failing-on-arm64.patch
    - Skip tests failing on arm64

vim (2:9.1.2141-1ubuntu4.4) resolute-security; urgency=medium

  * SECURITY UPDATE: Code injection via NetrwBookHistSave().
    - debian/patches/CVE-2026-47162.patch: Properly quote the directory name
      in runtime/pack/dist/opt/netrw/autoload/netrw.vim.
    - CVE-2026-47162
  * SECURITY UPDATE: Code Injection in cucumber filetype plugin.
    - debian/patches/CVE-2026-47167.patch: Use rubys Regexp.new() in
      runtime/ftplugin/cucumber.vim.
    - CVE-2026-47167
  * SECURITY UPDATE: Code execution with python3complete.
    - debian/patches/CVE-2026-52858.patch: Disable execution of import/from
      statements in runtime/autoload/python3complete.vim and
      ../pythoncomplete.vim
    - debian/patches/CVE-2026-52860.patch: Strip default expressions and
      annotations in runtime/autoload/python3complete.vim and
      ../pythoncomplete.vim
    - CVE-2026-52858
    - CVE-2026-52860
  * SECURITY UPDATE: Out-of-bounds read in update_snapshot().
    - debian/patches/CVE-2026-52859.patch: Bound loop in update_snapshot() in
      src/terminal.c.
    - CVE-2026-52859

Date: 2026-06-17 19:10:12.455179+00:00
Changed-By: Kyle Kernick <kyle.kernick at canonical.com>
Signed-By: Ubuntu Archive Robot <ubuntu-archive-robot at lists.canonical.com>
https://launchpad.net/ubuntu/+source/vim/2:9.1.2141-1ubuntu4.5
-------------- next part --------------
Sorry, changesfile not available.