CVE-2024-32487

less through 653 allows OS command execution via a newline character in the
name of a file, because quoting is mishandled in filename.c. Exploitation
typically requires use with attacker-controlled file names, such as the
files extracted from an untrusted archive. Exploitation also requires the
LESSOPEN environment variable, but this is set by default in many common
cases.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068938&gt;