CVE-2024-32487

Name	CVE-2024-32487
Description	less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1068938

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
less (PTS)	jessie	458-3	vulnerable
	stretch	481-2.1	vulnerable
	buster	487-0.1	vulnerable
	bullseye	551-2	vulnerable
	bookworm	590-2	vulnerable
	sid, trixie	590-2.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
less	source	(unstable)	590-2.1			1068938

https://www.openwall.com/lists/oss-security/2024/04/12/5
Fixed by: https://github.com/gwsw/less/commit/007521ac3c95bc76e3d59c6dbfe75d06c8075c33