Fix of 43 CVEs
* SECURITY UPDATE: crash when clearing the argument list while using it - debian/patches/CVE-2021-4166.patch: lock the argument list for ":all"; matches upstream patch 8.2.3884. - CVE-2021-4166 * SECURITY UPDATE: reading past end of completion with a long line - debian/patches/CVE-2022-2343.patch: build the inferred-case text in a growarray when it outgrows IObuff; matches upstream patch 9.0.0045. - CVE-2022-2343 * SECURITY UPDATE: memory access errors when calling setloclist() in an autocommand - debian/patches/CVE-2022-3016.patch: give an error if the list was changed unexpectedly and drop the stale pointer instead of storing it back; matches upstream patches 8.2.1677 and 9.0.0286. - CVE-2022-3016 * SECURITY UPDATE: SpellFileMissing autocmd may delete buffer - debian/patches/CVE-2022-3352.patch: disallow deleting the current buffer while loading a spell file; matches upstream patch 9.0.0614. - CVE-2022-3352 * SECURITY UPDATE: filetype autocmd may cause freed memory access - debian/patches/CVE-2022-3705.patch: set the quickfix-busy flag while filling the buffer; matches upstream patch 9.0.0805. - CVE-2022-3705 * SECURITY UPDATE: invalid memory access in substitute with function - debian/patches/CVE-2022-4141.patch: check for text or buffer being locked before jumping to a file; matches upstream patch 9.0.0947. - CVE-2022-4141
- Products
- vim, vim-athena, vim-common, vim-doc, vim-gnome, vim-gtk, vim-gtk3, vim-gui-common, vim-nox, vim-runtime, vim-tiny, xxd
- Affected versions
- Not specified
- Fixed versions
- 2:8.0.1453-1ubuntu1.13+tuxcare.els8
- CVEs
- CVE-2021-4166, CVE-2022-2343, CVE-2022-3016, CVE-2022-3352, CVE-2022-3705, CVE-2022-4141
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 11:41 UTC · Revision 1
Source evidence
* SECURITY UPDATE: crash when clearing the argument list while using it - debian/patches/CVE-2021-4166.patch: lock the argument list for ":all"; matches upstream patch 8.2.3884. - CVE-2021-4166 * SECURITY UPDATE: reading past end of completion with a long line - debian/patches/CVE-2022-2343.patch: build the inferred-case text in a growarray when it outgrows IObuff; matches upstream patch 9.0.0045. - CVE-2022-2343 * SECURITY UPDATE: memory access errors when calling setloclist() in an autocommand - debian/patches/CVE-2022-3016.patch: give an error if the list was changed unexpectedly and drop the stale pointer instead of storing it back; matches upstream patches 8.2.1677 and 9.0.0286. - CVE-2022-3016 * SECURITY UPDATE: SpellFileMissing autocmd may delete buffer - debian/patches/CVE-2022-3352.patch: disallow deleting the current buffer while loading a spell file; matches upstream patch 9.0.0614. - CVE-2022-3352 * SECURITY UPDATE: filetype autocmd may cause freed memory access - debian/patches/CVE-2022-3705.patch: set the quickfix-busy flag while filling the buffer; matches upstream patch 9.0.0805. - CVE-2022-3705 * SECURITY UPDATE: invalid memory access in substitute with function - debian/patches/CVE-2022-4141.patch: check for text or buffer being locked before jumping to a file; matches upstream patch 9.0.0947. - CVE-2022-4141
osv:CLSA-2026-1787917228
vim
Fixed versions: 2:8.0.1453-1ubuntu1.13+tuxcare.els8
vim-athena
Fixed versions: 2:8.0.1453-1ubuntu1.13+tuxcare.els8
vim-common
Fixed versions: 2:8.0.1453-1ubuntu1.13+tuxcare.els8
vim-doc
Fixed versions: 2:8.0.1453-1ubuntu1.13+tuxcare.els8
vim-gnome
Fixed versions: 2:8.0.1453-1ubuntu1.13+tuxcare.els8
vim-gtk
Fixed versions: 2:8.0.1453-1ubuntu1.13+tuxcare.els8
vim-gtk3
Fixed versions: 2:8.0.1453-1ubuntu1.13+tuxcare.els8
vim-gui-common
Fixed versions: 2:8.0.1453-1ubuntu1.13+tuxcare.els8
vim-nox
Fixed versions: 2:8.0.1453-1ubuntu1.13+tuxcare.els8
vim-runtime
Fixed versions: 2:8.0.1453-1ubuntu1.13+tuxcare.els8
vim-tiny
Fixed versions: 2:8.0.1453-1ubuntu1.13+tuxcare.els8
xxd
Fixed versions: 2:8.0.1453-1ubuntu1.13+tuxcare.els8
Complete source record
{
"id": "440e91261d7eeee760033b1cf7428137721633e122f30a18e418a23772b2d02a",
"url": "https://osv.dev/vulnerability/CLSA-2026-1787917228",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Fix of 43 CVEs",
"summary": "* SECURITY UPDATE: crash when clearing the argument list while using it - debian/patches/CVE-2021-4166.patch: lock the argument list for \":all\"; matches upstream patch 8.2.3884. - CVE-2021-4166 * SECURITY UPDATE: reading past end of completion with a long line - debian/patches/CVE-2022-2343.patch: build the inferred-case text in a growarray when it outgrows IObuff; matches upstream patch 9.0.0045. - CVE-2022-2343 * SECURITY UPDATE: memory access errors when calling setloclist() in an autocommand - debian/patches/CVE-2022-3016.patch: give an error if the list was changed unexpectedly and drop the stale pointer instead of storing it back; matches upstream patches 8.2.1677 and 9.0.0286. - CVE-2022-3016 * SECURITY UPDATE: SpellFileMissing autocmd may delete buffer - debian/patches/CVE-2022-3352.patch: disallow deleting the current buffer while loading a spell file; matches upstream patch 9.0.0614. - CVE-2022-3352 * SECURITY UPDATE: filetype autocmd may cause freed memory access - debian/patches/CVE-2022-3705.patch: set the quickfix-busy flag while filling the buffer; matches upstream patch 9.0.0805. - CVE-2022-3705 * SECURITY UPDATE: invalid memory access in substitute with function - debian/patches/CVE-2022-4141.patch: check for text or buffer being locked before jumping to a file; matches upstream patch 9.0.0947. - CVE-2022-4141",
"evidence": "osv:CLSA-2026-1787917228",
"products": [
{
"name": {
"value": "vim",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2:8.0.1453-1ubuntu1.13+tuxcare.els8",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-athena",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2:8.0.1453-1ubuntu1.13+tuxcare.els8",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-common",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2:8.0.1453-1ubuntu1.13+tuxcare.els8",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-doc",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2:8.0.1453-1ubuntu1.13+tuxcare.els8",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-gnome",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2:8.0.1453-1ubuntu1.13+tuxcare.els8",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-gtk",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2:8.0.1453-1ubuntu1.13+tuxcare.els8",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-gtk3",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2:8.0.1453-1ubuntu1.13+tuxcare.els8",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-gui-common",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2:8.0.1453-1ubuntu1.13+tuxcare.els8",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-nox",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2:8.0.1453-1ubuntu1.13+tuxcare.els8",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-runtime",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2:8.0.1453-1ubuntu1.13+tuxcare.els8",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "vim-tiny",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2:8.0.1453-1ubuntu1.13+tuxcare.els8",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xxd",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2:8.0.1453-1ubuntu1.13+tuxcare.els8",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1787917228",
"aliases": [
"CLSA-2026-1787917228"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:8.0.1453-1ubuntu1.13+tuxcare.els8"
}
]
}
],
"package": {
"name": "vim",
"purl": "pkg:deb/tuxcare/vim?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787917228.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:8.0.1453-1ubuntu1.13+tuxcare.els8"
}
]
}
],
"package": {
"name": "vim-athena",
"purl": "pkg:deb/tuxcare/vim-athena?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787917228.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:8.0.1453-1ubuntu1.13+tuxcare.els8"
}
]
}
],
"package": {
"name": "vim-common",
"purl": "pkg:deb/tuxcare/vim-common?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787917228.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:8.0.1453-1ubuntu1.13+tuxcare.els8"
}
]
}
],
"package": {
"name": "vim-doc",
"purl": "pkg:deb/tuxcare/vim-doc?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787917228.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:8.0.1453-1ubuntu1.13+tuxcare.els8"
}
]
}
],
"package": {
"name": "vim-gnome",
"purl": "pkg:deb/tuxcare/vim-gnome?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787917228.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:8.0.1453-1ubuntu1.13+tuxcare.els8"
}
]
}
],
"package": {
"name": "vim-gtk",
"purl": "pkg:deb/tuxcare/vim-gtk?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787917228.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:8.0.1453-1ubuntu1.13+tuxcare.els8"
}
]
}
],
"package": {
"name": "vim-gtk3",
"purl": "pkg:deb/tuxcare/vim-gtk3?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787917228.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:8.0.1453-1ubuntu1.13+tuxcare.els8"
}
]
}
],
"package": {
"name": "vim-gui-common",
"purl": "pkg:deb/tuxcare/vim-gui-common?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787917228.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:8.0.1453-1ubuntu1.13+tuxcare.els8"
}
]
}
],
"package": {
"name": "vim-nox",
"purl": "pkg:deb/tuxcare/vim-nox?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787917228.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:8.0.1453-1ubuntu1.13+tuxcare.els8"
}
]
}
],
"package": {
"name": "vim-runtime",
"purl": "pkg:deb/tuxcare/vim-runtime?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787917228.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:8.0.1453-1ubuntu1.13+tuxcare.els8"
}
]
}
],
"package": {
"name": "vim-tiny",
"purl": "pkg:deb/tuxcare/vim-tiny?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787917228.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2:8.0.1453-1ubuntu1.13+tuxcare.els8"
}
]
}
],
"package": {
"name": "xxd",
"purl": "pkg:deb/tuxcare/xxd?distro=ubuntu-18.04",
"ecosystem": "TuxCare:Ubuntu:18.04"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787917228.json"
}
}
],
"modified": "2026-10-26T09:32:03.750880162Z",
"provider": "osv",
"upstream": [
"CVE-2021-4166",
"CVE-2022-2343",
"CVE-2022-3016",
"CVE-2022-3352",
"CVE-2022-3705",
"CVE-2022-4141"
],
"references": [
"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787917228.html",
"https://nvd.nist.gov/vuln/detail/CVE-2021-3872",
"https://nvd.nist.gov/vuln/detail/CVE-2021-3973",
"https://nvd.nist.gov/vuln/detail/CVE-2021-3974",
"https://nvd.nist.gov/vuln/detail/CVE-2021-4166",
"https://nvd.nist.gov/vuln/detail/CVE-2022-0417",
"https://nvd.nist.gov/vuln/detail/CVE-2022-1886",
"https://nvd.nist.gov/vuln/detail/CVE-2022-1897",
"https://nvd.nist.gov/vuln/detail/CVE-2022-1927",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2000",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2042",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2182",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2210",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2257",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2264",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2284",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2285",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2286",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2287",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2289",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2343",
"https://nvd.nist.gov/vuln/detail/CVE-2022-2344",
"https://nvd.nist.gov/vuln/detail/CVE-2022-3016",
"https://nvd.nist.gov/vuln/detail/CVE-2022-3099",
"https://nvd.nist.gov/vuln/detail/CVE-2022-3234",
"https://nvd.nist.gov/vuln/detail/CVE-2022-3235",
"https://nvd.nist.gov/vuln/detail/CVE-2022-3256",
"https://nvd.nist.gov/vuln/detail/CVE-2022-3296",
"https://nvd.nist.gov/vuln/detail/CVE-2022-3324",
"https://nvd.nist.gov/vuln/detail/CVE-2022-3352",
"https://nvd.nist.gov/vuln/detail/CVE-2022-3591",
"https://nvd.nist.gov/vuln/detail/CVE-2022-3705",
"https://nvd.nist.gov/vuln/detail/CVE-2022-4141",
"https://nvd.nist.gov/vuln/detail/CVE-2022-4292",
"https://nvd.nist.gov/vuln/detail/CVE-2023-2610",
"https://nvd.nist.gov/vuln/detail/CVE-2023-4733",
"https://nvd.nist.gov/vuln/detail/CVE-2023-4735",
"https://nvd.nist.gov/vuln/detail/CVE-2023-4750",
"https://nvd.nist.gov/vuln/detail/CVE-2023-4751",
"https://nvd.nist.gov/vuln/detail/CVE-2023-4752",
"https://nvd.nist.gov/vuln/detail/CVE-2023-4781",
"https://nvd.nist.gov/vuln/detail/CVE-2023-5344",
"https://nvd.nist.gov/vuln/detail/CVE-2023-5535",
"https://nvd.nist.gov/vuln/detail/CVE-2026-73073"
]
},
"related_cves": [
{
"value": "CVE-2021-4166",
"evidence": "/upstream"
},
{
"value": "CVE-2022-2343",
"evidence": "/upstream"
},
{
"value": "CVE-2022-3016",
"evidence": "/upstream"
},
{
"value": "CVE-2022-3352",
"evidence": "/upstream"
},
{
"value": "CVE-2022-3705",
"evidence": "/upstream"
},
{
"value": "CVE-2022-4141",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 449547,
"published_at": "2026-10-23T22:25:50+00:00"
}