* SECURITY UPDATE: heap buffer over-read scanning for quote text objects with a stale Visual selection - debian/patches/CVE-2022-2124.patch: add a NUL-boundary check to the existing-Visual-selection quote-scan loop in current_quote() in src/textobject.c. - CVE-2022-2124 * SECURITY UPDATE: use-after-free using a mark position in a regexp - debian/patches/CVE-2021-3974.patch: refetch the current line under REG_MULTI after a mark lookup may have flushed it, in the NFA_MARK/NFA_MARK_GT/NFA_MARK_LT handling in src/regexp_nfa.c. - CVE-2021-3974 * SECURITY UPDATE: heap buffer over-read using z= in Visual mode beyond the end of the line - debian/patches/CVE-2022-0943.patch: clamp badlen to the actual line length in spell_suggest() in src/spellsuggest.c; the comparison is taken in its post-8.2.4565 form, folding in upstream's correction that casts both operands to int, because without it the subtraction is evaluated in size_t and underflows, leaving the clamp a no-op. - CVE-2022-0943 * SECURITY UPDATE: use-after-free reading a buffer for 'diff' without blocking autocommands - debian/patches/CVE-2023-5535.patch: block autocommands around the dummy-buffer readfile() in buf_contents_changed() in src/buffer.c. - CVE-2023-5535 * SECURITY UPDATE: use-after-free when 'tagfunc' wipes out the buffer holding 'complete' - debian/patches/CVE-2022-3297.patch: make a copy of 'complete' instead of aliasing the option value, revalidate curbuf after the completion callback, and validate the cursor line, in src/insexpand.c and src/move.c; the src/move.c hunk is taken in its post-9.0.0581 form, folding in upstream's same-day follow-up that clamps only the cursor line, because clamping the column there breaks incsearch at end of line. - CVE-2022-3297