8.6

CVE-2024-32487: debian debian_linux Static Code Injection

CVSS: 8.6v3.1HighAnalyzed
AliasesMGASA-2024-0139SUSE-SU-2024:1534-1SUSE-SU-2024:1550-1
Published 13-04-2024Last modified 02-08-2024
Open JSON

Vulnerability summary

CVE-2024-32487 is a high (CVSS 8.6) Static Code Injection vulnerability in debian debian_linux. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.6/10
010
High · v3.1 (CVE.org)
EPSS score
0.63%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3
DLA-3823-1DSA-5679-1RHSA-2024:4256

Timeline

  1. 13-04-2024
    PublishedVulnerability first disclosed.
  2. 02-08-2024
    Last modifiedVulnerability information updated.

Description

less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.63%

Chance of exploitation in the next 30 days

Percentile

49%

Versus all other CVEs

30-day change

0.00 pp

From 0.63% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.63%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse24 products
  • less&distro=SUSE Enterprise Storage 7.1< 530-150000.3.9.1
  • less&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 530-150000.3.9.1
  • less&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 530-150000.3.9.1
  • less&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 590-150400.3.9.1
  • less&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 590-150400.3.9.1
Opensuse5 products
  • less&distro=openSUSE Leap 15.5< 590-150400.3.9.1
  • less&distro=openSUSE Leap 15.6< 643-150600.3.3.1
  • less&distro=openSUSE Leap Micro 5.3< 590-150400.3.9.1
  • less&distro=openSUSE Leap Micro 5.4< 590-150400.3.9.1
  • less&distro=openSUSE Tumbleweed< 668-2.1
Netapp3 products
Redhat3 products
  • less< 0:590-4.el9_4 | < 0:458-10.el7_9 | < 0:530-2.el8_2 | < 0:530-3.el8_8 | < 0:530-2.el8_4 | < 0:530-3.el8_6 | < 0:590-2.el9_0 | < 0:590-3.el9_2
  • less-debuginfo< 0:590-4.el9_4 | < 0:458-10.el7_9 | < 0:530-2.el8_2 | < 0:530-3.el8_8 | < 0:530-2.el8_4 | < 0:530-3.el8_6 | < 0:590-2.el9_0 | < 0:590-3.el9_2
  • less-debugsource< 0:590-4.el9_4 | < 0:530-2.el8_2 | < 0:530-3.el8_8 | < 0:530-2.el8_4 | < 0:530-3.el8_6 | < 0:590-2.el9_0 | < 0:590-3.el9_2
Debian2 products
Greenwoodsoftware1 product
Mageia1 product
  • less< 632-1.2.mga9
Ubuntu1 product
  • less< 458-2ubuntu0.1~esm1 | < 481-2.1ubuntu0.2+esm2 | < 487-0.1ubuntu0.1~esm2 | < 551-1ubuntu0.3 | < 590-1ubuntu0.22.04.3 | < 590-2ubuntu2.1

8 vendors · 40 products

References

45 links
Show all 45 references