MGASA-2024-0139
- Source
- https://advisories.mageia.org/MGASA-2024-0139.html
- Import Source
- https://advisories.mageia.org/MGASA-2024-0139.json
- JSON Data
- https://api.osv.dev/v1/vulns/MGASA-2024-0139
- Related
- Published
- 2024-04-19T01:16:42Z
- Modified
- 2024-04-19T00:59:17Z
- Summary
- Updated less packages fix security vulnerability
- Details
-
less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases. (CVE-2024-32487)
- References
-
- https://advisories.mageia.org/MGASA-2024-0139.html
- https://bugs.mageia.org/show_bug.cgi?id=33102
- https://www.openwall.com/lists/oss-security/2024/04/12/5
- https://www.openwall.com/lists/oss-security/2024/04/12/6
- https://www.openwall.com/lists/oss-security/2024/04/13/2
- https://www.openwall.com/lists/oss-security/2024/04/15/1
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:9 / less
Package
- Name
- less
- Purl
- pkg:rpm/mageia/less?distro=mageia-9