Lucene search

K
mageiaGentoo FoundationMGASA-2024-0139
HistoryApr 19, 2024 - 4:16 a.m.

Updated less packages fix security vulnerability

2024-04-1904:16:42
Gentoo Foundation
advisories.mageia.org
20
os command execution
newline character
filename mishandling
attacker controlled file
untrusted archive
lessopen environment variable
default setting
cve-2024-32487
unix

7.2 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.3%

less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases. (CVE-2024-32487)

OSVersionArchitecturePackageVersionFilename
Mageia9noarchless< 632-1.2less-632-1.2.mga9