CVE-2004-2264: gnu less
Vulnerability summary
CVE-2004-2264 is a medium (CVSS 6.4) vulnerability in gnu less. EPSS estimates a 2.03% chance of exploitation in the next 30 days, higher than 80.7% of scored vulnerabilities.
Timeline
- 19-07-2005PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
Format string bug in the open_altfile function in filename.c for GNU less 382, 381, and 358 might allow local users to cause a denial of service or possibly execute arbitrary code via format strings in the LESSOPEN environment variable. NOTE: since less is not setuid or setgid, then this is not a vulnerability unless there are plausible scenarios under which privilege boundaries could be crossed
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
2.03%
Chance of exploitation in the next 30 days
Percentile
81%
Versus all other CVEs
30-day change
0.00 pp
From 2.03% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Gnu1 product
- less358 | 381 | 382
1 vendor · 1 product