openSUSE Security Update: Security update for vifm
______________________________________________________________________________
Announcement ID: openSUSE-SU-2026:0276-1
Rating: important
References: #1273413
Cross-References: CVE-2026-8997
Affected Products:
openSUSE Backports SLE-15-SP7
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for vifm fixes the following issues:
- Update to 0.14.4: Invocation:
* Reworked --help output to be more compact and readable. Documentation:
* Added menu index to the documentation. Patch by CaptainFantastic.
* Improved description of the local filter in the documentation.
* Documented quoting and escaping on command-line. Patch by Kirill
Rekhov.
* Documented name conflict resolution dialog. Patch by Kirill Rekhov.
* Rewrote documentation about command-line ranges to make it complete
and more readable.
* Improved wording in documentation describing general behaviour of
visual mode. Menus and dialogs:
* Improved potentially confusing wording in the dialog confirming exit
while background jobs are running.
* Don't offer "append the tail" conflict resolution option for al and rl
operations because it's inappropriate for creation of symbolic links.
File preview:
* Display an error on trying to switch from external preview to raw
mode. Integration:
* Fall back to using standard::fast-content-type from GLib if
standard::content-type is missing. Patch by Jan Palus (a.k.a. jpalus).
Other changes:
* Added example of handling .deb-files to sample vifmrc. Patch by Kirill
Rekhov.
* Updated sample vifmrc files to use vi as a last resort if it exists.
* Updated list of categories in .desktop-file. Patch by Jared Cervantes
(a.k.a. Jaredy899). Fixes:
* Fixed :normal not being able to run commands which end with whitespace.
* Fixed printing newline on cancelling choosing a directory via
--choose-dir option.
* Fixed escaping characters with codes greater than 127 producing
garbage.
* Fixed vifm-media-osx script for modern versions of OS X.
* Fixed weird delays in FUSE when running an AppImage caused by a
trailing colon in $LD_LIBRARY_PATH.
* Fixed a small memory leak on trying to display a map menu which
doesn't show up because it would be empty.
* Fixed vifm-pause and other helpers not being available from within
AppImage.
* Fixed vifm.vim not cleaning up buffers properly when used as a netrw
replacement.
* Fixed a crash if GLib didn't return a file type. Patch by Jan Palus
(a.k.a. jpalus).
* Fixed undoing of chmod operation not restoring owner's read permission.
* Fixed incorrect progress indicator for dp and do keys in compare view.
* Fixed UID/GID occasionally not being formatted as requested (numeric
vs. symbolic form) in the UI.
* Fixed rl normal mode key sometimes not moving cursor to the newly
inserted link and simultaneously logging partial name in the undo
history message, which is merely informative.
* Fixed :open not entering symbolic links to directories if there is no
vifm executable in $PATH.
* Fixed :yank and :delete not handling optional count parameter
correctly (a regression since v0.11-beta).
* Fixed completion of :highlight truncating long custom column names.
* Fixed a Lua column disabling search highlighting for all columns to
its right.
* Fixed a buffer overflow in trie implementation (CVE-2026-8997)
(boo#1273413)
* Fixed Lua modules written in C not being loaded on Unix-like systems.
- Update to 0.14.3: Documentation:
* Improved documentation on the use of registers. Menus and dialogs:
* Say primary instead of default in the title of :colorscheme menu.
Other changes:
* Provided more details on file handlers and viewers in sample vifmrc
files. Fixes:
* Fixed picking trash directory when rooted trash is included in
'trashdir' and root is writable. Regression in v0.14.2
(unfortunately, testing this automatically is problematic).
* Fixed unlimited growth of directory histories when 'history' is set to
its default value or not set at all in vifmrc.
* Fixed abort due to assertion on displaying a statusbar message with a
newline when 'shortmess' includes T.
- Update to 0.14.2:
* Fix an issue with %r in 'trashdir' when root file-system is read-only
(like on macOS) and also broke build with musl libc.
* Trash directories specified via an absolute path and containing %u
weren't created with 700 permissions.
* Don't use strverscmp() of musl if it doesn't sort things correctly (A
must be greater than 0). This avoids numerical sorting results
looking different with musl.
- Update to 0.14.1:
* Fixed a preview-related crash on Windows easily reproducible using
binary files.
* Fixed a tree-related crash when using {fileext} or {ext} columns.
* Fixed 'trashdir' with %r not working on BSD-like systems.
* Fixed vifm path/to/file incorrectly running file handling in current
working directory.
* Restored terminal access for commands that use %i macro (so :!echo ...
%i can affect the terminal as before v0.12.1). Use %i & for ignoring
output while denying terminal accesses.
* Fixed occasional incorrect truncation of wide characters on drawing
columns broken while introducing column-specific highlighting in
v0.14-beta.
* Clarified information on comments after :commands. Provided some
information on copy-on-write file copying. Improved documentation on
leaving compare and custom views.
- Update to 0.14:
* Somewhat incompatible changes This release contains a number of
changes which are technically non-backwards compatible. However, all
of them should have very little negative impact (i.e., hard to notice
the change without reading the changelog). At the same time, a bug,
fixing which is likely to have an impact on user configuration, has
been identified but not yet fixed to give a chance to update all
affected vifmrc files. If a bug is likely to be relied on by the
configuration, a dialog with the explanation and instructions will
appear.
* Sorting and non-Latin characters Until this release Vifm has always
used byte sorting (effectively, sorting
of UTF-8 byte sequences). From now on a form of Unicode normalization
is applied to strings when sorting views and completion results. The
change can be expanded to other cases in future releases. The
measured performance impact is negligible (several percent).
Practically, this means that characters like a and ä are now grouped
together regardless of the way in which diacritic is being encoded.
Some characters can still appear in weird non-alphabetic positions
because full Unicode normalization results in losing case sensitivity
and is therefore not applied.
* Addressing some longtime woes For one reason or another some
inconvenient peculiarities have accumulated
over the years. Time has come to replace workarounds with something
better:
+ global variables (g:var) replace the use of environmental
variables for internal purposes, thus avoiding polluting environment of
child processes
+ use of :let to invoke a builtin function discarding its result is
superseded by a proper :call command
+ use of execute 'normal! gl' to run selection now has :open command
as a better alternative
+ size of selection can now be queried via selected() (previous
releases required expand('%c') == expand('%f') or an equivalent trick)
+ %{expression} macro in 'statusline' can now have } embedded as \}
(\\ still means two slashes)
+ dialogs now recognize Enter and Escape keys as "yes" and "no"
replies
* More useful menus :copen recalled last navigation menu for years, but
that's not always enough. Now up to 25 such menus are stored after
their use and can be navigated to via :chistory/:colder/:cnewer. In
addition, :grep or :find can be rerun on the same set of commands
right from the menu which previously required leaving the menu just to
get back to it. History of command-line in menus is now also managed
and stored, making staying in menu mode for longer a more pleasant
experience.
* UI improvements Navigation between views/tabs via new :wingo command
with optional incremental completion thanks to new 'wildinc' option
(applicable to any
other command or all of them at once). Ability to highlight a view
column (:highlight column:size ...), specify how highlighting applies
('hloptions'), set a separator between miller columns in set
fillchars+=millersep:'|', shorten columns in the middle (^ in
'viewcolumn'). Also, displaying of CJK characters on Windows should
have much fewer issues now.
* Lua API Slowly adding new functionality. This batch comes with things
like primitive file operations, ability to create custom views or
menus and handling ranges of :commands.
* Other Search matches can be traversed via Tab and Shift-Tab while in
the prompt (applies to navigation mode as well). An invalid expression
in :if or :elseif no longer just skips that command, now all commands
up to and including matching :endif are skipped to avoid executing
half-random sequences of commands due to a mistake, which also results
in better error messages. Previously, :elseif was also evaluating its
expression even some earlier branch was already taken. :rename now
asks whether file move is intended instead of assuming a user mistake
and refusing to proceed. Support MTP devices by bundled vifm-media
script if simple-mtpfs is installed. Also improve what devices are
offered for mounting (e.g., don't
offer a whole drive if it contains partitions). v:version to branch
depending on release.
* Fixes Get preview graphics out of the way in more cases (like when
opening menus). Terminals with more than 32768 color pairs should not
cause visual defects or crashes anymore. Merging of directories was
either not asking for confirmation or aborting after skipping a file.
Paths with some unreadable characters were not processed due to a
regression. Directories weren't counted in estimates of file
operations. && operator was always evaluating both branches instead of
properly short-circuiting. %a macro of 'statusline' was displaying
wrong values on non-Linux Unix-like systems. :compare falsely claimed
that files of identical size and with common prefix are identical.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP7:
zypper in -t patch openSUSE-2026-276=1
Package List:
- openSUSE Backports SLE-15-SP7 (aarch64 i586 ppc64le s390x x86_64):
vifm-0.14.4-bp157.2.3.1
References:
https://www.suse.com/security/cve/CVE-2026-8997.html
https://bugzilla.suse.com/1273413
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.