CVE-2024-32487

NameCVE-2024-32487
Descriptionless through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-5679-1
Debian Bugs1068938

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
less (PTS)buster487-0.1vulnerable
bullseye551-2vulnerable
bullseye (security)551-2+deb11u2fixed
bookworm590-2vulnerable
bookworm (security)590-2.1~deb12u2fixed
sid, trixie643-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
lesssourcebullseye551-2+deb11u2DSA-5679-1
lesssourcebookworm590-2.1~deb12u2DSA-5679-1
lesssource(unstable)590-2.11068938

Notes

https://www.openwall.com/lists/oss-security/2024/04/12/5
Fixed by: https://github.com/gwsw/less/commit/007521ac3c95bc76e3d59c6dbfe75d06c8075c33

Search for package or bug name: Reporting problems