Summary
It was discovered that less mishandled newline characters in file names. If
a user or automated system were tricked into opening specially crafted
files, an attacker could possibly use this issue to execute arbitrary
commands on the host.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | less | 551-1ubuntu0.3 |
| Ubuntu · 22.04 LTS 22.04:LTS | less | 590-1ubuntu0.22.04.3 |
| Ubuntu · 24.04 LTS 24.04:LTS | less | 590-2ubuntu2.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | less | 458-2ubuntu0.1~esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | less | 481-2.1ubuntu0.2+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | less | 487-0.1ubuntu0.1~esm2 |
Vulnerabilities 1
-
High 8.6
less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandl…
References
-
report
https://ubuntu.com/security/CVE-2024-32487