Your message dated Sun, 25 Oct 2026 12:34:18 +0000
with message-id <[email protected]>
and subject line Bug#1150939: fixed in vifm 0.14.5-1
has caused the Debian Bug report #1150939,
regarding vifm: CVE-2026-110237
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150939: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150939
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: vifm
X-Debbugs-CC: [email protected]
Severity: important
Tags: security
Hi,
The following vulnerability was published for vifm.
CVE-2026-110237[0]:
| Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the
| shared temporary directory without checking ownership, allowing
| local users to execute commands as another user. Attackers can pre-
| create a world-writable vifm-ipc-vifm FIFO and write IPC packets
| with -c and ! shell commands that execute with the victim's
| privileges.
This doesn't seem to have been reported upstream yet.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-110237
https://www.cve.org/CVERecord?id=CVE-2026-110237
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Source: vifm
Source-Version: 0.14.5-1
Done: Kirill Rekhov <[email protected]>
We believe that the bug you reported is fixed in the latest version of
vifm, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Kirill Rekhov <[email protected]> (supplier of updated vifm package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 24 Oct 2026 00:03:27 +0000
Source: vifm
Architecture: source
Version: 0.14.5-1
Distribution: unstable
Urgency: medium
Maintainer: Kirill Rekhov <[email protected]>
Changed-By: Kirill Rekhov <[email protected]>
Closes: 1150939
Changes:
vifm (0.14.5-1) unstable; urgency=medium
.
* New upstream release
* d/watch: update to new version 5 format
* Fix CVE-2026-110237: unsafe IPC pipe reuse
(Closes: #1150939)
Checksums-Sha1:
7c0c29af766969a1a24bc9fd693592f77031849b 1902 vifm_0.14.5-1.dsc
c2fbabd29e2780d92f027606675de7e28a9d213c 2497445 vifm_0.14.5.orig.tar.gz
6dd04ff73936844f552b04ac02a7dff9532054fe 9272 vifm_0.14.5-1.debian.tar.xz
8531ceeb72440850cffac0cf3dad54da4ce1f88d 6123 vifm_0.14.5-1_amd64.buildinfo
Checksums-Sha256:
177b4939110b20bfd95c8f18996b2b8e32b49a717cc01014687d641f8941f0f8 1902
vifm_0.14.5-1.dsc
2bb0b7ca2aa8be0d5df2a7271d4e50f27aec053652298c2b14be38703e206ab3 2497445
vifm_0.14.5.orig.tar.gz
02972869f2d2c63e4772844d04c876769c1b276dc20796636ab9bfc24e1c7ff3 9272
vifm_0.14.5-1.debian.tar.xz
0b46898154f44c50efdf3d3b8b7ecc0d47f0ee2b573fa400f74496c2e0a08969 6123
vifm_0.14.5-1_amd64.buildinfo
Files:
7a871eac3bdc1e9c4f660abfdffadf4f 1902 utils optional vifm_0.14.5-1.dsc
f52dab713f2a38a6c8501d61c37442ce 2497445 utils optional vifm_0.14.5.orig.tar.gz
8f9da8f3fe264b1181d12df10c4d0481 9272 utils optional
vifm_0.14.5-1.debian.tar.xz
9fa552650b96e48d41fc9f20f59b3714 6123 utils optional
vifm_0.14.5-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJKBAEBCgA0FiEEJkB2nf2hqqD4Y9GuXyxZBVGc4KAFAmrdTOwWHGtyZWtob3Yu
ZGV2QGdtYWlsLmNvbQAKCRBfLFkFUZzgoE3gD/9Fy4F5lLjDc9JP8mtAxLm67dRT
kufpNvOPhlv1eEjCkGdC5BN0rjF2Vxpjt/FuIXkUOR9ttGBl+GMQ6WQF6kqMMCEQ
4bLhIYYT0RlZJXGSzxINbFRzQYeU7UVp9MIaenOC9Aaa+xgsYvfHIRriNBsnVuQ7
1LO6CHU71N4RZEp/y9Gh6Qb9EOT4KnDJ6s9wcDBnSRtDJuAKjsYqBPTCgd+SsLv9
g4WJMhMJ5L1oyPqFy9Y1Z02dvxyc9wSfKaRKfEmtd/+tFymiXdipyRLQ9lq6cwGj
MlrMCNX6Y7WO2BmYE5nLmp+HEZt2Y9xO//VHX3Zz2nx+L5E/Z0Tl4478Gc5V3nRY
JgJzgbci+qPJT0ymtSFxl9VMIqv+7AYBDNZ8FqLxfKvdtNdJtqJObtJdXyFb95xM
npruSNHUzCqfeFYGVfxzd3cmbKkdnENtMyMpP3HyM3amdOFUmEd80i6StD7K//cz
HyTS2FVtSVa45XsNJh4sUechCHOzwz8bM+KBJZCcRL68WopQbSOCSvaZDIuLvs7F
lTfbAu1BQuVDnZLsWK3xqDE/BivfNfw5AkwIAN1aHjKRv5jGHFPZVS/UjiJ82hGp
4VYCBvJ0uT4IQegRxHAow1mZWLZMBJFJ41o7n9EzWQcOUpn3jwvdBKKVvB3FKJL/
sLzHdg07eB/IVnfw1A==
=SfZt
-----END PGP SIGNATURE-----
pgpG20wsF32y5.pgp
Description: PGP signature
--- End Message ---
