On Wed Oct 7, 2026 at 1:23 PM CEST, Hitendra Prajapati via lists.openembedded.org wrote: > Pick the patch from [1], also referenced in the NVD report [2]. > > [1] https://github.com/vim/vim/commit/581a2f3ac9c6f96a26324f6b2c8c11415fd0d452 > [2] https://nvd.nist.gov/vuln/detail/CVE-2026-73076 > > Signed-off-by: Hitendra Prajapati <[email protected]> > --- > .../vim/files/CVE-2026-73076.patch | 136 ++++++++++++++++++ > meta/recipes-support/vim/vim.inc | 1 + > 2 files changed, 137 insertions(+) > create mode 100644 meta/recipes-support/vim/files/CVE-2026-73076.patch > > diff --git a/meta/recipes-support/vim/files/CVE-2026-73076.patch > b/meta/recipes-support/vim/files/CVE-2026-73076.patch > new file mode 100644 > index 0000000000..9ef6aec99a > --- /dev/null > +++ b/meta/recipes-support/vim/files/CVE-2026-73076.patch > @@ -0,0 +1,136 @@ > +From 581a2f3ac9c6f96a26324f6b2c8c11415fd0d452 Mon Sep 17 00:00:00 2001 > +From: Christian Brabandt <[email protected]> > +Date: Fri, 24 Jul 2026 17:43:51 +0200 > +Subject: [PATCH] patch 9.2.0847: [security]: vimball: code execution via > + .VimballRecord file > + > +Problem: [security]: vimball: code execution via .VimballRecord file > + (tdjackey) > +Solution: Forbid arbitrary commands, fix broken directory deletion code, > + refactor code > + > +Github Security Advisory: > +https://github.com/vim/vim/security/advisories/GHSA-r22p-fhw4-84p2 > + > +Signed-off-by: Christian Brabandt <[email protected]> > + > +CVE: CVE-2026-73076 > +Upstream-Status: Backport > [https://github.com/vim/vim/commit/581a2f3ac9c6f96a26324f6b2c8c11415fd0d452] > +Signed-off-by: Hitendra Prajapati <[email protected]> > +--- > + runtime/autoload/vimball.vim | 58 ++++++++++++++++++++++-------------- > + 1 file changed, 35 insertions(+), 23 deletions(-)
Hello, That patch changes in a non-trivial way from upstream. Can you check that all those changes are intended and explain them in the patch message? Thanks! -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#247725): https://lists.openembedded.org/g/openembedded-core/message/247725 Mute This Topic: https://lists.openembedded.org/mt/121625918/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
