EulerOS Virtualization 2.10.0 : vim (EulerOS-SA-2026-1202)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(297293);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/03");

  script_cve_id(
    "CVE-2025-1215",
    "CVE-2025-22134",
    "CVE-2025-24014",
    "CVE-2025-26603",
    "CVE-2025-29768",
    "CVE-2025-53905",
    "CVE-2025-53906"
  );

  script_name(english:"EulerOS Virtualization 2.10.0 : vim (EulerOS-SA-2026-1202)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS Virtualization host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is
affected by the following vulnerabilities :

    Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in
    Vims tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar
    archives. Impact is low because this exploit requires direct user interaction. However, successfully
    exploitation can lead to overwriting sensitive files or placing executable code in privileged locations,
    depending on the permissions of the process editing the archive. The victim must edit such a file using
    Vim which will reveal the filename and the file content, a careful user may suspect some strange things
    going on. Successful exploitation could results in the ability to execute arbitrary commands on the
    underlying operating system. Version 9.1.1552 contains a patch for the vulnerability.(CVE-2025-53905)

    Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in
    Vims zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip
    archives. Impact is low because this exploit requires direct user interaction. However, successfully
    exploitation can lead to overwriting sensitive files or placing executable code in privileged locations,
    depending on the permissions of the process editing the archive. The victim must edit such a file using
    Vim which will reveal the filename and the file content, a careful user may suspect some strange things
    going on. Successful exploitation could results in the ability to execute arbitrary commands on the
    underlying operating system. Version 9.1.1551 contains a patch for the vulnerability.(CVE-2025-53906)

    When switching to other buffers using the :all command and visual mode still being active, this may cause
    a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access
    beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before
    opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try
    to access a position if the position is greater than the corresponding buffer line. Impact is medium since
    the user must have switched on visual mode when executing the :all ex command. The Vim project would like
    to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch
    v9.1.1003(CVE-2025-22134)

    Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In
    silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode.
    However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim
    by feeding some binary characters to Vim. The function that handles the scrolling however may be
    triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been
    allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.(CVE-2025-24014)

    A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects
    unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It
    is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this
    issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade
    the affected component.(CVE-2025-1215)

    Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in
    versions prior to 9.1.1198. The impact is medium because a user must be made to view such an archive with
    Vim and then press 'x' on such a strange filename. The issue has been fixed as of Vim patch
    v9.1.1198.(CVE-2025-29768)

    Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages
    using the `:redir` ex command to register, variables and files. It also allows to show the contents of
    registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a
    register, Vim will free the register content before storing the new content in the register. Now when
    redirecting the `:display` command to a register that is being displayed, Vim will free the content while
    shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the
    ex_display() function, that it does not try to redirect to a register while displaying this register at
    the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers
    (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will
    fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero
    when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no
    known workarounds for this vulnerability.(CVE-2025-26603)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization vim security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-1202
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f447a1d9");
  script_set_attribute(attribute:"solution", value:
"Update the affected vim packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-1215");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/01/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/31");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:vim-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:vim-enhanced");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:vim-filesystem");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:vim-minimal");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:2.10.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (uvp != "2.10.0") audit(AUDIT_OS_NOT, "EulerOS Virtualization 2.10.0");
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "x86" >!< cpu) audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

var flag = 0;

var pkgs = [
  "vim-common-9.0-1.h22.r5.eulerosv2r10",
  "vim-enhanced-9.0-1.h22.r5.eulerosv2r10",
  "vim-filesystem-9.0-1.h22.r5.eulerosv2r10",
  "vim-minimal-9.0-1.h22.r5.eulerosv2r10"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "vim");
}