less vulnerability

2024-04-2900:00:00

ubuntu.com

ubuntu

less program

arbitrary commands

CVSS3

8.6

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

7.2

Confidence

Low

EPSS

Percentile

10.3%

JSON

Releases

Ubuntu 24.04 LTS
Ubuntu 23.10
Ubuntu 22.04 LTS
Ubuntu 20.04 LTS
Ubuntu 18.04 ESM
Ubuntu 16.04 ESM
Ubuntu 14.04 ESM

Packages

less - pager program similar to more

Details

It was discovered that less mishandled newline characters in file names. If
a user or automated system were tricked into opening specially crafted
files, an attacker could possibly use this issue to execute arbitrary
commands on the host.

OSVersionArchitecturePackageVersionFilename
Ubuntu24.04noarchless< 590-2ubuntu2.1UNKNOWN
Ubuntu24.04noarchless-dbgsym< 590-2ubuntu2.1UNKNOWN
Ubuntu23.10noarchless< 590-2ubuntu0.23.10.2UNKNOWN
Ubuntu23.10noarchless-dbgsym< 590-2ubuntu0.23.10.2UNKNOWN
Ubuntu22.04noarchless< 590-1ubuntu0.22.04.3UNKNOWN
Ubuntu22.04noarchless-dbgsym< 590-1ubuntu0.22.04.3UNKNOWN
Ubuntu20.04noarchless< 551-1ubuntu0.3UNKNOWN
Ubuntu20.04noarchless-dbgsym< 551-1ubuntu0.3UNKNOWN
Ubuntu18.04noarchless< 487-0.1ubuntu0.1~esm2UNKNOWN
Ubuntu18.04noarchless< 487-0.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	24.04	noarch	less	< 590-2ubuntu2.1	UNKNOWN
Ubuntu	24.04	noarch	less-dbgsym	< 590-2ubuntu2.1	UNKNOWN
Ubuntu	23.10	noarch	less	< 590-2ubuntu0.23.10.2	UNKNOWN
Ubuntu	23.10	noarch	less-dbgsym	< 590-2ubuntu0.23.10.2	UNKNOWN
Ubuntu	22.04	noarch	less	< 590-1ubuntu0.22.04.3	UNKNOWN
Ubuntu	22.04	noarch	less-dbgsym	< 590-1ubuntu0.22.04.3	UNKNOWN
Ubuntu	20.04	noarch	less	< 551-1ubuntu0.3	UNKNOWN
Ubuntu	20.04	noarch	less-dbgsym	< 551-1ubuntu0.3	UNKNOWN
Ubuntu	18.04	noarch	less	< 487-0.1ubuntu0.1~esm2	UNKNOWN
Ubuntu	18.04	noarch	less	< 487-0.1	UNKNOWN