QSN-8679-1: Vim vulnerability
2026-08-25

Summary:
Vim could be made to crash or run programs as your login if it opened
a specially crafted file.

Details:
It was discovered that Vim incorrectly handled certain tags files. An
attacker could possibly use this issue to execute arbitrary code.

Affected QuantaStor releases:
  6.9.1.001 jammy: vim 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.9.1.001 jammy: vim-common 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.9.1.001 jammy: vim-runtime 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.9.1.001 jammy: vim-tiny 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.9.1.001 jammy: xxd 2:8.2.3995-1ubuntu2.18 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.9.0.464 jammy: vim 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.9.0.464 jammy: vim-common 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.9.0.464 jammy: vim-runtime 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.9.0.464 jammy: vim-tiny 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.9.0.464 jammy: xxd 2:8.2.3995-1ubuntu2.18 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.6.015 jammy: vim 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.6.015 jammy: vim-common 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.6.015 jammy: vim-runtime 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.6.015 jammy: vim-tiny 2:8.2.3995-1ubuntu2.36 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.6.015 jammy: xxd 2:8.2.3995-1ubuntu2.18 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.5.018 jammy: vim 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.5.018 jammy: vim-common 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.5.018 jammy: vim-runtime 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.5.018 jammy: vim-tiny 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.5.018 jammy: xxd 2:8.2.3995-1ubuntu2.18 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.4.038 jammy: vim 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.4.038 jammy: vim-common 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.4.038 jammy: vim-runtime 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.4.038 jammy: vim-tiny 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.4.038 jammy: xxd 2:8.2.3995-1ubuntu2.18 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.3.018 jammy: vim 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.3.018 jammy: vim-common 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.3.018 jammy: vim-runtime 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.3.018 jammy: vim-tiny 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.3.018 jammy: xxd 2:8.2.3995-1ubuntu2.18 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.2.002 jammy: vim 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.2.002 jammy: vim-common 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.2.002 jammy: vim-runtime 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.2.002 jammy: vim-tiny 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.2.002 jammy: xxd 2:8.2.3995-1ubuntu2.18 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.1.007 jammy: vim 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.1.007 jammy: vim-common 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.1.007 jammy: vim-runtime 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.1.007 jammy: vim-tiny 2:8.2.3995-1ubuntu2.34 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.1.007 jammy: xxd 2:8.2.3995-1ubuntu2.18 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.0.205 jammy: vim 2:8.2.3995-1ubuntu2.32 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.0.205 jammy: vim-common 2:8.2.3995-1ubuntu2.32 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.0.205 jammy: vim-runtime 2:8.2.3995-1ubuntu2.32 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.0.205 jammy: vim-tiny 2:8.2.3995-1ubuntu2.32 (fixed in 2:8.2.3995-1ubuntu2.36)
  6.8.0.205 jammy: xxd 2:8.2.3995-1ubuntu2.18 (fixed in 2:8.2.3995-1ubuntu2.36)

CVEs: CVE-2026-73073

References:
  https://ubuntu.com/security/notices/USN-8679-1