Summary
David Leadbeater discovered that less was not properly handling escape
sequences when displaying raw control characters. A maliciously formed
OSC 8 hyperlink could possibly be used by an attacker to cause a denial of
service.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | less | 590-1ubuntu0.22.04.1 |
Vulnerabilities 1
-
High 7.5
In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal.
References
-
report
https://ubuntu.com/security/CVE-2022-46663