CVE-2024-32487
8.6
HIGH
CVSS 3.1
EPSS 0.63%
Description
less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.
How to fix CVE-2024-32487
To remediate CVE-2024-32487, upgrade the affected package to a fixed version below.
- —upgrade to 551-2+deb11u2 or later
Is CVE-2024-32487 being exploited?
Low — EPSS is 0.6%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 551-2+deb11u2
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.6 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |