Logo
›
›vulnerability›CVE-2024-32487
Name
CVE-2024-32487
Source
NVD ( link)Debian ( link)
Description
less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.
CWEs
CWE-96
Published Date
Updated Date
Workaround
-
Advisories
http://www.openwall.com/lists/oss-security/2024/04/15/1Mailing List
https://github.com/gwsw/less/commit/007521ac3c95bc76e3d59c6dbfe75d06c8075c33Patch
https://lists.debian.org/debian-lts-announce/2024/05/msg00018.htmlMailing List
https://security.netapp.com/advisory/ntap-20240605-0009/Vendor Advisory
https://www.openwall.com/lists/oss-security/2024/04/12/5Mailing List
https://www.openwall.com/lists/oss-security/2024/04/13/2Mailing List
http://www.openwall.com/lists/oss-security/2024/04/15/1Mailing List
https://github.com/gwsw/less/commit/007521ac3c95bc76e3d59c6dbfe75d06c8075c33Patch
https://lists.debian.org/debian-lts-announce/2024/05/msg00018.htmlMailing List
https://security.netapp.com/advisory/ntap-20240605-0009/Vendor Advisory
https://www.openwall.com/lists/oss-security/2024/04/12/5Mailing List
https://www.openwall.com/lists/oss-security/2024/04/13/2Mailing List

Analysis#

Affected Component
Analysis
less
Patched

Vulnerability Ratings#

8.6
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
less
buildroot
2025.02.x
661
Not Affected
less
buildroot
master
704
Not Affected
less
openwrt
master
692-r1
Not Affected
less
openwrt
openwrt-25.12
685-r1
Not Affected
less
yocto
master
704
Not Affected
less
yocto
scarthgap
643
Exploitable

Resolved with patches#

less (yocto:kirkstone)

#
Title
Author
Resolve
1
Fix bug when viewing a file whose name contains a newline.
Mark Nudelman <markn@greenwoodsoftware.com>
CVE-2024-32487