mirror of
https://git.yoctoproject.org/poky
synced 2026-10-23 07:28:17 +00:00
Siddharth Doshi
68da6e5e76
Picking patch as per [1], and same patch is mentioned in [2] References: [1] https://nvd.nist.gov/vuln/detail/CVE-2026-55895 [2] https://security-tracker.debian.org/tracker/CVE-2026-55895 (From OE-Core rev: 87b2def5858ea51650b1e0381ed104d5670c50b1) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
54 lines
2.1 KiB
Diff
54 lines
2.1 KiB
Diff
From 0d286458d71ff7b4d759621dd9a567aa9354819a Mon Sep 17 00:00:00 2001
|
|
From: Yasuhiro Matsumoto <mattn.jp@gmail.com>
|
|
Date: Tue, 16 Jun 2026 21:00:28 +0000
|
|
Subject: [PATCH 11/17] patch 9.2.0663: [security]: runtime(netrw): code
|
|
injection in local file deletion
|
|
|
|
Problem: [security]: s:NetrwLocalRmFile() escapes only the backslash in
|
|
the file name before passing it to :execute, so a name
|
|
containing "|" injects arbitrary Ex commands when the file is
|
|
deleted (cipher-creator)
|
|
Solution: Use fnameescape() to correctly escape the file name
|
|
(Yasuhiro Matsumoto).
|
|
|
|
Github Security Advisory:
|
|
https://github.com/vim/vim/security/advisories/GHSA-vhh8-v6wx-hjjh
|
|
|
|
Supported by AI
|
|
|
|
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
|
|
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
|
|
|
Upstream-Status: Backport [https://github.com/vim/vim/commit/55bc757a5d436e59d50fe43f7cda94b118f86cb2]
|
|
CVE: CVE-2026-55895
|
|
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
|
|
---
|
|
runtime/pack/dist/opt/netrw/autoload/netrw.vim | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
|
|
index 9014ca339b..af43f469d1 100644
|
|
--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim
|
|
+++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
|
|
@@ -3025,7 +3025,7 @@ function s:NetrwBrowse(islocal,dirname)
|
|
elseif !a:islocal && dirname !~ '[\/]$' && dirname !~ '^"'
|
|
" s:NetrwBrowse : remote regular file handler {{{3
|
|
if bufname(dirname) != ""
|
|
- exe "NetrwKeepj b ".bufname(dirname)
|
|
+ exe "NetrwKeepj b ".fnameescape(bufname(dirname))
|
|
else
|
|
" attempt transfer of remote regular file
|
|
|
|
@@ -8737,7 +8737,7 @@ function s:NetrwLocalRmFile(path, fname, all)
|
|
call netrw#msg#Notify('ERROR', printf("unable to delete <%s>!", rmfile))
|
|
else
|
|
" Remove file only if there are no pending changes
|
|
- execute printf('silent! bwipeout %s', rmfile)
|
|
+ execute printf('silent! bwipeout %s', fnameescape(rmfile))
|
|
endif
|
|
|
|
elseif dir && (all || empty(ok))
|
|
--
|
|
2.44.4
|
|
|