less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-32487
• gwsw/less@007521a
• https://www.openwall.com/lists/oss-security/2024/04/12/5
• https://www.openwall.com/lists/oss-security/2024/04/13/2
• http://www.openwall.com/lists/oss-security/2024/04/15/1
• https://lists.debian.org/debian-lts-announce/2024/05/msg00018.html
• https://security.netapp.com/advisory/ntap-20240605-0009