Vulnerability in Gnu Less
CVE-2004-2264
Format string bug in the open_altfile function in filename.c for GNU less 382, 381, and 358 might allow local users to cause a denial of service or possibly execute arbitrary code via format strings in the LESSOPEN environment variable. NOTE: since less is not setuid or setgid, then this is not a vulnerability unless there are plausible scenarios under which privilege boundaries could be crossed
EPSS: 0.020 (79.0th percentile) — read the EPSS interpretation.
Affected products
- Gnu Less — versions 358, 381, 382
- N/a — versions n/a
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (mailing-list, x_refsource_FULLDISC)
- cve@mitre.org (mailing-list, x_refsource_FULLDISC)
Frequently asked questions
- What is CVE-2004-2264?
- CVE-2004-2264 is a vulnerability in Gnu Less. Published 2004-12-31.
- Is CVE-2004-2264 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.