Vulnerability Description
less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Greenwoodsoftware | Less | <= 653 |
| Debian | Debian Linux | 10.0 |
| Netapp | Bootstrap Os | - |
| Netapp | Hci Compute Node | - |
| Netapp | Hci Storage Nodes | - |
| Netapp | Solidfire | - |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2024/04/15/1Mailing List
- https://github.com/gwsw/less/commit/007521ac3c95bc76e3d59c6dbfe75d06c8075c33Patch
- https://lists.debian.org/debian-lts-announce/2024/05/msg00018.htmlMailing List
- https://security.netapp.com/advisory/ntap-20240605-0009/Vendor Advisory
- https://www.openwall.com/lists/oss-security/2024/04/12/5Mailing List
- https://www.openwall.com/lists/oss-security/2024/04/13/2Mailing ListPatch
- http://www.openwall.com/lists/oss-security/2024/04/15/1Mailing List
- https://github.com/gwsw/less/commit/007521ac3c95bc76e3d59c6dbfe75d06c8075c33Patch
- https://lists.debian.org/debian-lts-announce/2024/05/msg00018.htmlMailing List
- https://security.netapp.com/advisory/ntap-20240605-0009/Vendor Advisory
- https://www.openwall.com/lists/oss-security/2024/04/12/5Mailing List
- https://www.openwall.com/lists/oss-security/2024/04/13/2Mailing ListPatch
FAQ
What is CVE-2024-32487?
CVE-2024-32487 is a vulnerability with a CVSS score of 8.6 (HIGH). less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled fi...
How severe is CVE-2024-32487?
CVE-2024-32487 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-32487?
Check the references section above for vendor advisories and patch information. Affected products include: Greenwoodsoftware Less, Debian Debian Linux, Netapp Bootstrap Os, Netapp Hci Compute Node, Netapp Hci Storage Nodes.