https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:26:13 +0000 https://cve.radiocsirt.org/vuln/alsa-2024:3513 <p><strong>Affected:</strong> AlmaLinux:9: less</p> <p>The &#34;less&#34; utility is a text file browser that resembles &#34;more&#34;, but allows users to move backwards in the file as well as forwards. Since &#34;less&#34; does not read the entire input file at startup, it also starts more quickly than ordinary text editors.</p> <p>Security Fix(es):</p> <p>* less: OS command injection (CVE-2024-32487)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: less</p> <p>The &#34;less&#34; utility is a text file browser that resembles &#34;more&#34;, but allows users to move backwards in the file as well as forwards. Since &#34;less&#34; does not read the entire input file at startup, it also starts more quickly than ordinary text editors.</p> <p>Security Fix(es):</p> <p>* less: OS command injection (CVE-2024-32487)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2024:3513 https://cve.radiocsirt.org/vuln/bdu:2024-03717 bdu:2024-03717 https://cve.radiocsirt.org/vuln/bdu:2024-03717 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0646 certfr-2024-avi-0646 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0646 https://cve.radiocsirt.org/vuln/euvd-2026-5132 EUVD-2026-5132 https://cve.radiocsirt.org/vuln/euvd-2026-5132 https://cve.radiocsirt.org/vuln/fkie_cve-2024-32487 <p>less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.</p> <p>less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-32487 https://cve.radiocsirt.org/vuln/ghsa-f53j-pgm5-c4r3 <p>less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.</p> <p>less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.</p> https://cve.radiocsirt.org/vuln/ghsa-f53j-pgm5-c4r3 https://cve.radiocsirt.org/vuln/gsd-2024-32487 gsd-2024-32487 https://cve.radiocsirt.org/vuln/gsd-2024-32487 https://cve.radiocsirt.org/vuln/msrc_cve-2024-32487 msrc_CVE-2024-32487 https://cve.radiocsirt.org/vuln/msrc_cve-2024-32487 https://cve.radiocsirt.org/vuln/oesa-2024-1502 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: less, openEuler:22.03-LTS: less, openEuler:22.03-LTS-SP2: less, openEuler:22.03-LTS-SP3: less</p> <p>Less is a pager. A pager is a program that displays text files. Other pagers commonly in use are more and pg. Pagers are often used in command-line environments like the Unix shell and the MS-DOS command prompt to display files. Security Fix(es): less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.(CVE-2024-32487)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: less, openEuler:22.03-LTS: less, openEuler:22.03-LTS-SP2: less, openEuler:22.03-LTS-SP3: less</p> <p>Less is a pager. A pager is a program that displays text files. Other pagers commonly in use are more and pg. Pagers are often used in command-line environments like the Unix shell and the MS-DOS command prompt to display files. Security Fix(es): less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.(CVE-2024-32487)</p> https://cve.radiocsirt.org/vuln/oesa-2024-1502 https://cve.radiocsirt.org/vuln/opensuse-su-2025:14862-1 <p>less-668-2.1 on GA media</p> <p>less-668-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:14862-1 https://cve.radiocsirt.org/vuln/rhsa-2024:4366 <p>less: OS command injection</p> <p>less: OS command injection</p> https://cve.radiocsirt.org/vuln/rhsa-2024:4366 https://cve.radiocsirt.org/vuln/ssa-202008 <p>An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used &#34;group blacklisting&#34; (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation. GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey. remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt. binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f. libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the ar…</p> <p>An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used &#34;group blacklisting&#34; (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation. GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey. remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt. binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f. libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the ar…</p> https://cve.radiocsirt.org/vuln/ssa-202008 https://cve.radiocsirt.org/vuln/suse-su-2024:1534-1 <p>Security update for less</p> <p>Security update for less</p> https://cve.radiocsirt.org/vuln/suse-su-2024:1534-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-32487 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: less, Ubuntu:Pro:16.04:LTS: less, Ubuntu:Pro:18.04:LTS: less, Ubuntu:20.04:LTS: less, Ubuntu:22.04:LTS: less, Ubuntu:24.04:LTS: less</p> <p>less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: less, Ubuntu:Pro:16.04:LTS: less, Ubuntu:Pro:18.04:LTS: less, Ubuntu:20.04:LTS: less, Ubuntu:22.04:LTS: less, Ubuntu:24.04:LTS: less</p> <p>less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-32487 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0880 <p>Ein lokaler Angreifer kann eine Schwachstelle in less ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein lokaler Angreifer kann eine Schwachstelle in less ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0880