Summary
It was discovered that less incorrectly handled certain file names.
An attacker could possibly use this issue to cause a crash or execute
arbitrary commands.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | less | 551-1ubuntu0.2 |
| Ubuntu · 22.04 LTS 22.04:LTS | less | 590-1ubuntu0.22.04.2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | less | 481-2.1ubuntu0.2+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | less | 487-0.1ubuntu0.1~esm1 |
Vulnerabilities 1
-
High 7.8
close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE.
References
-
report
https://ubuntu.com/security/CVE-2022-48624