Amazon Linux 2023 Security Advisory: ALAS-2024-622
Advisory Release Date: 2024-05-23 21:49 Pacific
Advisory Updated Date: 2024-05-28 22:46 Pacific
Severity:
Important
Issue Overview:
less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases. (CVE-2024-32487)
Affected Packages:
less
Issue Correction:
Run dnf update less --releasever 2023.4.20240528 to update your system.
New Packages:
aarch64:
less-debuginfo-608-2.amzn2023.0.2.aarch64
less-debugsource-608-2.amzn2023.0.2.aarch64
less-608-2.amzn2023.0.2.aarch64
src:
less-608-2.amzn2023.0.2.src
x86_64:
less-debuginfo-608-2.amzn2023.0.2.x86_64
less-608-2.amzn2023.0.2.x86_64
less-debugsource-608-2.amzn2023.0.2.x86_64