mirror of
https://git.yoctoproject.org/poky
synced 2026-10-17 17:47:02 +00:00
vim: Fix for CVE-2026-73078
Pick the patch from [1], also referenced in the NVD report [2]. [1] https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-73078 (From OE-Core rev: 60254acd1a9ca4ce984bf4006b84e46f9727491f) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Hitendra Prajapati authored and 
Paul Barker committed
1 parent
19b9b1f98a
commit
a004a41739
2 files changed
+95
No files matched your search
@@ -0,0 +1,94 @@
|
||||
From 29c6fd090d4520592f8be7d9ec81190edf25ef69 Mon Sep 17 00:00:00 2001
|
||||
From: Yasuhiro Matsumoto <mattn.jp@gmail.com>
|
||||
Date: Mon, 6 Jul 2026 13:54:03 +0900
|
||||
Subject: [PATCH] patch 9.2.0840: [security]: code injection in netrw via
|
||||
bookmarks
|
||||
|
||||
Problem: [security]: code injection in netrw via bookmarks and history
|
||||
(David Carliez)
|
||||
Solution: Escape the '|' explicitly (Yasuhiro Matsumoto)
|
||||
|
||||
The bookmark and history menu builders interpolate paths into :execute'd
|
||||
:menu commands using g:netrw_menu_escape, which did not escape the Ex
|
||||
command separator '|'. A crafted path could break out of the :menu command
|
||||
and run arbitrary Ex/shell commands when the menu was built or triggered.
|
||||
|
||||
Add '|' to g:netrw_menu_escape for the menu names, escape the :e right-hand
|
||||
side with fnameescape(), and quote the netrw#MakeTgt() argument with
|
||||
string() instead of raw single-quote interpolation.
|
||||
|
||||
Github Security Advisory:
|
||||
https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2
|
||||
|
||||
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
|
||||
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
||||
|
||||
CVE: CVE-2026-73078
|
||||
Upstream-Status: Backport [https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69]
|
||||
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
||||
---
|
||||
runtime/pack/dist/opt/netrw/autoload/netrw.vim | 16 +++++++++-------
|
||||
1 file changed, 9 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
|
||||
index 49ccebc07a..a3198dc689 100644
|
||||
--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim
|
||||
+++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
|
||||
@@ -380,7 +380,7 @@ if has("win32")
|
||||
else
|
||||
call s:NetrwInit("g:netrw_glob_escape",'*[]?`{~$\')
|
||||
endif
|
||||
-call s:NetrwInit("g:netrw_menu_escape",'.&? \')
|
||||
+call s:NetrwInit("g:netrw_menu_escape",'.&? \|')
|
||||
call s:NetrwInit("s:netrw_map_escape","<|\n\r\\\<C-V>\"")
|
||||
if has("gui_running") && (&enc == 'utf-8' || &enc == 'utf-16' || &enc == 'ucs-4')
|
||||
let s:treedepthstring= "│ "
|
||||
@@ -3734,13 +3734,14 @@ function s:NetrwBookmarkMenu()
|
||||
if exists("g:netrw_bookmarklist") && g:netrw_bookmarklist != [] && g:netrw_dirhistmax > 0
|
||||
let cnt= 1
|
||||
for bmd in g:netrw_bookmarklist
|
||||
- let bmd= escape(bmd,g:netrw_menu_escape)
|
||||
+ let ebmd= escape(bmd,g:netrw_menu_escape)
|
||||
+ let fbmd= escape(fnameescape(bmd),'|')
|
||||
|
||||
" show bookmarks for goto menu
|
||||
- exe 'sil! menu '.g:NetrwMenuPriority.".2.".cnt." ".g:NetrwTopLvlMenu.'Bookmarks.'.bmd.' :e '.bmd."\<cr>"
|
||||
+ exe 'sil! menu '.g:NetrwMenuPriority.".2.".cnt." ".g:NetrwTopLvlMenu.'Bookmarks.'.ebmd.' :e '.fbmd."\<cr>"
|
||||
|
||||
" show bookmarks for deletion menu
|
||||
- exe 'sil! menu '.g:NetrwMenuPriority.".8.2.".cnt." ".g:NetrwTopLvlMenu.'Bookmarks\ and\ History.Bookmark\ Delete.'.bmd.' '.cnt."mB"
|
||||
+ exe 'sil! menu '.g:NetrwMenuPriority.".8.2.".cnt." ".g:NetrwTopLvlMenu.'Bookmarks\ and\ History.Bookmark\ Delete.'.ebmd.' '.cnt."mB"
|
||||
let cnt= cnt + 1
|
||||
endfor
|
||||
|
||||
@@ -3756,7 +3757,8 @@ function s:NetrwBookmarkMenu()
|
||||
let priority = g:netrw_dirhistcnt + histcnt
|
||||
if exists("g:netrw_dirhist_{cnt}")
|
||||
let histdir= escape(g:netrw_dirhist_{cnt},g:netrw_menu_escape)
|
||||
- exe 'sil! menu '.g:NetrwMenuPriority.".3.".priority." ".g:NetrwTopLvlMenu.'History.'.histdir.' :e '.histdir."\<cr>"
|
||||
+ let ehistdir= escape(fnameescape(g:netrw_dirhist_{cnt}),'|')
|
||||
+ exe 'sil! menu '.g:NetrwMenuPriority.".3.".priority." ".g:NetrwTopLvlMenu.'History.'.histdir.' :e '.ehistdir."\<cr>"
|
||||
endif
|
||||
let first = 0
|
||||
let cnt = ( cnt - 1 ) % g:netrw_dirhistmax
|
||||
@@ -7104,7 +7106,7 @@ function s:NetrwTgtMenu()
|
||||
let tgtdict[bmd]= cnt
|
||||
let ebmd= escape(bmd,g:netrw_menu_escape)
|
||||
" show bookmarks for goto menu
|
||||
- exe 'sil! menu <silent> '.g:NetrwMenuPriority.".19.1.".cnt." ".g:NetrwTopLvlMenu.'Targets.'.ebmd." :call netrw#MakeTgt('".bmd."')\<cr>"
|
||||
+ exe 'sil! menu <silent> '.g:NetrwMenuPriority.".19.1.".cnt." ".g:NetrwTopLvlMenu.'Targets.'.ebmd." :call netrw#MakeTgt(".escape(string(bmd),'|').")\<cr>"
|
||||
let cnt= cnt + 1
|
||||
endfor
|
||||
endif
|
||||
@@ -7122,7 +7124,7 @@ function s:NetrwTgtMenu()
|
||||
endif
|
||||
let tgtdict[histentry] = histcnt
|
||||
let ehistentry = escape(histentry,g:netrw_menu_escape)
|
||||
- exe 'sil! menu <silent> '.g:NetrwMenuPriority.".19.2.".priority." ".g:NetrwTopLvlMenu.'Targets.'.ehistentry." :call netrw#MakeTgt('".histentry."')\<cr>"
|
||||
+ exe 'sil! menu <silent> '.g:NetrwMenuPriority.".19.2.".priority." ".g:NetrwTopLvlMenu.'Targets.'.ehistentry." :call netrw#MakeTgt(".escape(string(histentry),'|').")\<cr>"
|
||||
endif
|
||||
let histcnt = histcnt + 1
|
||||
endwhile
|
||||
--
|
||||
2.50.1
|
||||
|
||||
@@ -54,6 +54,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \
|
||||
file://CVE-2026-73073.patch \
|
||||
file://CVE-2026-73074.patch \
|
||||
file://CVE-2026-73077.patch \
|
||||
file://CVE-2026-73078.patch \
|
||||
"
|
||||
|
||||
PV .= ".1683"
|
||||
|
||||
Reference in new issue
Block a user