PT-2026-29691 · Vim+4 · Zip.Vim+5

Mmajchr · Publicado 2026-04-02 · Atualizado 2026-06-03 · CVE-2026-35177

Positive Technologies (AI Summary) · Pt

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vim versões anteriores a 9.2.0280

Description Um bypass de caminho no plugin zip.vim do Vim permite a sobrescrição de arquivos arbitrários ao abrir arquivos zip especialmente criados. Isso contorna uma correção anterior.

Recommendations Atualize para a versão 9.2.0280 ou posterior.

Correção

DoS

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

ALSA-2026:22711

ALSA-2026:22717

ALSA-2026:22730

BDU:2026-05671

CVE-2026-35177

ECHO-33BB-95D6-B867

MGASA-2026-0083

OESA-2026-2177

RHSA-2026:22711

RHSA-2026:22717

RHSA-2026:22730

USN-8213-1

USN-8246-1

Produtos afetados

Linuxmint

Red Os

Rocky Linux

Ubuntu

Vim

Zip.Vim

Referências · 45

• https://github.com/vim/vim/security/advisories/GHSA-jc86-w7vm-8p24 · Aviso do Fabricante
• https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9 · Nota
• https://access.redhat.com/errata/RHSA-2026:22717 · Nota
• https://osv.dev/vulnerability/ALSA-2026:22717 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-35177 · Nota de Segurança
• https://osv.dev/vulnerability/USN-8213-1 · Aviso do Fabricante
• https://security.alpinelinux.org/vuln/CVE-2026-35177 · Nota
• https://osv.dev/vulnerability/MGASA-2026-0083 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-8246-1 · Aviso do Fabricante
• https://docs.bell-sw.com/security/cves/CVE-2026-35177 · Nota
• https://ubuntu.com/security/CVE-2026-39881 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=35308 · Nota
• https://openwall.com/lists/oss-security/2026/03/31/14 · Nota
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2177 · Nota
• https://t.me/msrcreports/3750 · Publicação no Telegram