debian/less vulnerabilities

Latest debian/less CVEs

Newest publication first

1. DLA-3823-1 less - security update

   Published 2024-05-27

   Unknown

2. DSA-5679-1 less - security update

   Published 2024-05-03

   Unknown

3. CVE-2024-32487 less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled fi...

   Published 2024-04-13

   High·CVSS 8.6

   less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation al...

4. CVE-2022-48624 close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE.

   Published 2024-02-19

   High·CVSS 7.8

   close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE.

5. CVE-2022-46663 In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal.

   Published 2023-02-07

   High·CVSS 7.5

   In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal.

6. CVE-2014-9488 The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, which triggers an out-of-bounds read.

   Published 2015-04-14

   High·CVSS 10.0

   The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, which triggers an out-of-bounds read.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.