Hi everyone,
in September I patched the following CVEs in vim/trixie:
Fix CVE-2026-73078
Fix CVE-2026-73077
Fix CVE-2026-73076
Fix CVE-2026-73073
Fix CVE-2026-73072 + fix regression
I also triaged the following CVEs that do not affect trixie and older:
CVE-2026-57451 - introduced in 9.2.0320, trixie and older unaffected
CVE-2026-57453 - introduced in v9.1.1784, trixie and older unaffected
CVE-2026-34714 - introduced in 9.1.1391, 664701eb7
CVE-2026-57454 - introduced in 9.2.0320, b3faeecc9
CVE-2026-73071 - introduced in 9.2.0511, f8126294a
CVE-2026-73075 - introduced in 9.2.0469, 975e191dc
I have notified the security team and asked them how to proceed with the
vim/trixie update, now that all CVEs are fixed.
I also worked on fixing the following CVEs in vim/bookworm:
Fix CVE-2026-73078
Fix CVE-2026-73077
Fix CVE-2026-73076
Fix CVE-2026-73073
Fix CVE-2026-73072 + fix regression
Fix CVE-2026-59858
Fix CVE-2026-59857
Fix CVE-2026-59856
Fix CVE-2026-57456
Fix CVE-2026-57455
Fix CVE-2026-57452
Fix CVE-2026-55892 + fix regression
Fix CVE-2026-55693
Fix CVE-2026-52860
Fix CVE-2026-52858 + fix regression
Fix CVE-2026-47167
Fix CVE-2026-47162
Fix CVE-2026-46483
Fix CVE-2026-45130
Fix CVE-2026-44656 + fix regression
Fix CVE-2026-43961
Fix CVE-2026-42307
Fix CVE-2026-41411
Fix CVE-2026-39881
Fix CVE-2026-35177
Fix CVE-2026-34982 + fix regression
Fix CVE-2026-33412
Fix CVE-2026-28421 + fix regression
Fix CVE-2026-28420
Fix CVE-2026-28418
Fix CVE-2026-28417
Fix CVE-2026-26269
Fix CVE-2026-25749
Fix CVE-2025-53906
Fix CVE-2025-53905 + fix regression
with the last one in the list requiring significant time and backport of four
other related patches.
I'm currently in process of preparing the upload for vim/bookworm.
Thanks to our sponsors for making this work possible, and to Freexian for
coordinating these efforts!
Regards,
Lee Garrett,
Debian LTS Team
