CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-46663 – less: crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal
https://notcve.org/view.php?id=CVE-2022-46663
In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal. A vulnerability was found in less. This flaw allows crafted data to result in "less -R" not filtering ANSI escape sequences sent to the terminal. • http://www.greenwoodsoftware.com/less/news.609.html http://www.openwall.com/lists/oss-security/2023/02/07/7 https://github.com/gwsw/less/commit/a78e1351113cef564d790a730d657a321624d79c https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LR7AUWB34JD4PCW3HHASBEDGGHFWPAQP https://security.gentoo.org/glsa/202310-11 https://www.openwall.com/lists/oss-security/2023/02/07/7 https://access.redhat.com/security/cve/CVE-2022-46663 https://bugzilla.redhat.com/show_bug&# •
CVSS: 10.0EPSS: 1%CPEs: 3EXPL: 0CVE-2014-9488
https://notcve.org/view.php?id=CVE-2014-9488
The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, which triggers an out-of-bounds read. La función is_utf8_well_formed en GNU less anterior a 475 permite a atacantes remotos tener un impacto no especificado a través de caracteres UFT-8 malformados, lo que provoca una lectura fuera de rango. • http://advisories.mageia.org/MGASA-2015-0139.html http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159449.html http://lists.opensuse.org/opensuse-updates/2015-03/msg00077.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:199 https://blog.fuzzing-project.org/3-less-out-of-bounds-read-access-TFPA-0022014.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.4EPSS: 0%CPEs: 3EXPL: 0CVE-2004-2264
https://notcve.org/view.php?id=CVE-2004-2264
Format string bug in the open_altfile function in filename.c for GNU less 382, 381, and 358 might allow local users to cause a denial of service or possibly execute arbitrary code via format strings in the LESSOPEN environment variable. NOTE: since less is not setuid or setgid, then this is not a vulnerability unless there are plausible scenarios under which privilege boundaries could be crossed • http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0794.html http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0811.html http://securitytracker.com/id?1010988 http://www.osvdb.org/9014 https://exchange.xforce.ibmcloud.com/vulnerabilities/17032 •