{
    "summary": {
        "snap": {
            "added": [],
            "removed": [],
            "diff": []
        },
        "deb": {
            "added": [],
            "removed": [],
            "diff": [
                "xxd"
            ]
        }
    },
    "diff": {
        "deb": [
            {
                "name": "xxd",
                "from_version": {
                    "source_package_name": "vim",
                    "source_package_version": "2:8.2.3995-1ubuntu2.34",
                    "version": "2:8.2.3995-1ubuntu2.34"
                },
                "to_version": {
                    "source_package_name": "vim",
                    "source_package_version": "2:8.2.3995-1ubuntu2.35",
                    "version": "2:8.2.3995-1ubuntu2.35"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-28417",
                        "url": "https://ubuntu.com/security/CVE-2026-28417",
                        "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-02-27 22:16:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73071",
                        "url": "https://ubuntu.com/security/CVE-2026-73071",
                        "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73072",
                        "url": "https://ubuntu.com/security/CVE-2026-73072",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73074",
                        "url": "https://ubuntu.com/security/CVE-2026-73074",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73076",
                        "url": "https://ubuntu.com/security/CVE-2026-73076",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73077",
                        "url": "https://ubuntu.com/security/CVE-2026-73077",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-73078",
                        "url": "https://ubuntu.com/security/CVE-2026-73078",
                        "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-08-11 16:17:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [
                    2163785
                ],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-28417",
                                "url": "https://ubuntu.com/security/CVE-2026-28417",
                                "cve_description": "Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-02-27 22:16:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73071",
                                "url": "https://ubuntu.com/security/CVE-2026-73071",
                                "cve_description": "Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73072",
                                "url": "https://ubuntu.com/security/CVE-2026-73072",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73074",
                                "url": "https://ubuntu.com/security/CVE-2026-73074",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73076",
                                "url": "https://ubuntu.com/security/CVE-2026-73076",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73077",
                                "url": "https://ubuntu.com/security/CVE-2026-73077",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-73078",
                                "url": "https://ubuntu.com/security/CVE-2026-73078",
                                "cve_description": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-08-11 16:17:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY REGRESSION: Incomplete fix for CVE-2026-28417 (LP: #2163785)",
                            "    - debian/patches/CVE-2026-28417-pre1.patch: Add NetrwValidateHostname in",
                            "      runtime/autoload/netrw.vim",
                            "    - debian/patches/CVE-2026-28417.patch: Add fixes to NetrwValidateHostname",
                            "      in runtime/autoload/netrw.vim",
                            "  * SECURITY UPDATE: Use-after-free on json decode error.",
                            "    - debian/patches/CVE-2026-73071.patch: Report the position from the",
                            "      current reader in src/json.c.",
                            "    - CVE-2026-73071",
                            "  * SECURITY UPDATE: Heap buffer overflow in set_sofo().",
                            "    - debian/patches/CVE-2026-73072.patch: Reset sl_sal_first in",
                            "      src/spellfile.c.",
                            "    - CVE-2026-73072",
                            "  * SECURITY UPDATE: Heap overflow when adding > 65535 text properties.",
                            "    - debian/patches/CVE-2026-73074.patch: Verify that the number of text",
                            "      properties falls within the limit in src/errors.h and src/textprop.c.",
                            "    - CVE-2026-73074",
                            "  * SECURITY UPDATE: Code execution via VimballRecord file.",
                            "    - debian/patches/CVE-2026-73076.patch: Forbid arbitrary commands, fix",
                            "      broken directory deletion code, and refactor code in",
                            "      runtime/autoload/vimball.vim",
                            "    - CVE-2026-73076",
                            "  * SECURITY UPDATE: Arbitrary code execution via keyword lookup.",
                            "    - debian/patches/CVE-2026-73077.patch: For powershell, quote the commands",
                            "      using single quotes, for zsh pass the argument as a separate list",
                            "      item to term_start()/system() in runtime/ftplugin/ps1.vim and",
                            "      ../zsh.vim.",
                            "    - CVE-2026-73077",
                            "  * SECURITY UPDATE: Code injection in netrw via bookmarks.",
                            "    - debian/patches/CVE-2026-73078.patch: Escape the '|' explicitly in",
                            "      runtime/autoload/netrw.vim.",
                            "    - CVE-2026-73078",
                            ""
                        ],
                        "package": "vim",
                        "version": "2:8.2.3995-1ubuntu2.35",
                        "urgency": "medium",
                        "distributions": "jammy-security",
                        "launchpad_bugs_fixed": [
                            2163785
                        ],
                        "author": "Kyle Kernick <kyle.kernick@canonical.com>",
                        "date": "Tue, 18 Aug 2026 15:47:19 -0600"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            }
        ],
        "snap": []
    },
    "added": {
        "deb": [],
        "snap": []
    },
    "removed": {
        "deb": [],
        "snap": []
    },
    "notes": "Changelog diff for Ubuntu 22.04 jammy image from daily image serial 20260820 to 20260822",
    "from_series": "jammy",
    "to_series": "jammy",
    "from_serial": "20260820",
    "to_serial": "20260822",
    "from_manifest_filename": "daily_manifest.previous",
    "to_manifest_filename": "manifest.current"
}