From: Siddharth Doshi <[email protected]> Picking patch as per [1], and same patch is mentioned in [2]
References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-55895 [2] https://security-tracker.debian.org/tracker/CVE-2026-55895 Signed-off-by: Siddharth Doshi <[email protected]> --- .../vim/files/CVE-2026-55895.patch | 53 +++++++++++++++++++ meta/recipes-support/vim/vim.inc | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta/recipes-support/vim/files/CVE-2026-55895.patch diff --git a/meta/recipes-support/vim/files/CVE-2026-55895.patch b/meta/recipes-support/vim/files/CVE-2026-55895.patch new file mode 100644 index 0000000000..0084006b72 --- /dev/null +++ b/meta/recipes-support/vim/files/CVE-2026-55895.patch @@ -0,0 +1,53 @@ +From 0d286458d71ff7b4d759621dd9a567aa9354819a Mon Sep 17 00:00:00 2001 +From: Yasuhiro Matsumoto <[email protected]> +Date: Tue, 16 Jun 2026 21:00:28 +0000 +Subject: [PATCH 11/17] patch 9.2.0663: [security]: runtime(netrw): code + injection in local file deletion + +Problem: [security]: s:NetrwLocalRmFile() escapes only the backslash in + the file name before passing it to :execute, so a name + containing "|" injects arbitrary Ex commands when the file is + deleted (cipher-creator) +Solution: Use fnameescape() to correctly escape the file name + (Yasuhiro Matsumoto). + +Github Security Advisory: +https://github.com/vim/vim/security/advisories/GHSA-vhh8-v6wx-hjjh + +Supported by AI + +Signed-off-by: Yasuhiro Matsumoto <[email protected]> +Signed-off-by: Christian Brabandt <[email protected]> + +Upstream-Status: Backport [https://github.com/vim/vim/commit/55bc757a5d436e59d50fe43f7cda94b118f86cb2] +CVE: CVE-2026-55895 +Signed-off-by: Siddharth Doshi <[email protected]> +--- + runtime/pack/dist/opt/netrw/autoload/netrw.vim | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +index 9014ca339b..af43f469d1 100644 +--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim ++++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim +@@ -3025,7 +3025,7 @@ function s:NetrwBrowse(islocal,dirname) + elseif !a:islocal && dirname !~ '[\/]$' && dirname !~ '^"' + " s:NetrwBrowse : remote regular file handler {{{3 + if bufname(dirname) != "" +- exe "NetrwKeepj b ".bufname(dirname) ++ exe "NetrwKeepj b ".fnameescape(bufname(dirname)) + else + " attempt transfer of remote regular file + +@@ -8737,7 +8737,7 @@ function s:NetrwLocalRmFile(path, fname, all) + call netrw#msg#Notify('ERROR', printf("unable to delete <%s>!", rmfile)) + else + " Remove file only if there are no pending changes +- execute printf('silent! bwipeout %s', rmfile) ++ execute printf('silent! bwipeout %s', fnameescape(rmfile)) + endif + + elseif dir && (all || empty(ok)) +-- +2.44.4 + diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc index 64e3eab106..5a4778fe7c 100644 --- a/meta/recipes-support/vim/vim.inc +++ b/meta/recipes-support/vim/vim.inc @@ -40,6 +40,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \ file://CVE-2026-47167.patch \ file://CVE-2026-55693.patch \ file://CVE-2026-55892.patch \ + file://CVE-2026-55895.patch \ " PV .= ".1683" -- 2.34.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241752): https://lists.openembedded.org/g/openembedded-core/message/241752 Mute This Topic: https://lists.openembedded.org/mt/120400861/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
