Security update for less SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:1534-1 Final 1 1 2024-05-06T12:55:36Z current 2024-05-06T12:55:36Z 2024-05-06T12:55:36Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for less This update for less fixes the following issues: - CVE-2024-32487: Fixed mishandling of \n character in paths when LESSOPEN is set leads to OS command execution. (bsc#1222849) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/sle-micro-rancher/5.2:latest-2024-1534,Container suse/sle-micro/5.1/toolbox:latest-2024-1534,Container suse/sle-micro/5.2/toolbox:latest-2024-1534,Image SLES15-SP2-SAP-Azure-LI-BYOS-Production-2024-1534,Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production-2024-1534,Image SLES15-SP3-BYOS-Azure-2024-1534,Image SLES15-SP3-BYOS-EC2-HVM-2024-1534,Image SLES15-SP3-BYOS-GCE-2024-1534,Image SLES15-SP3-CHOST-BYOS-Aliyun-2024-1534,Image SLES15-SP3-CHOST-BYOS-Azure-2024-1534,Image SLES15-SP3-CHOST-BYOS-EC2-2024-1534,Image SLES15-SP3-CHOST-BYOS-GCE-2024-1534,Image SLES15-SP3-CHOST-BYOS-SAP-CCloud-2024-1534,Image SLES15-SP3-HPC-BYOS-Azure-2024-1534,Image SLES15-SP3-HPC-BYOS-EC2-HVM-2024-1534,Image SLES15-SP3-HPC-BYOS-GCE-2024-1534,Image SLES15-SP3-Micro-5-1-BYOS-Azure-2024-1534,Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM-2024-1534,Image SLES15-SP3-Micro-5-1-BYOS-GCE-2024-1534,Image SLES15-SP3-Micro-5-2-BYOS-Azure-2024-1534,Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM-2024-1534,Image SLES15-SP3-Micro-5-2-BYOS-GCE-2024-1534,Image SLES15-SP3-SAP-Azure-LI-BYOS-Production-2024-1534,Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production-2024-1534,Image SLES15-SP3-SAP-BYOS-Azure-2024-1534,Image SLES15-SP3-SAP-BYOS-EC2-HVM-2024-1534,Image SLES15-SP3-SAP-BYOS-GCE-2024-1534,Image SLES15-SP3-SAPCAL-Azure-2024-1534,Image SLES15-SP3-SAPCAL-EC2-HVM-2024-1534,Image SLES15-SP3-SAPCAL-GCE-2024-1534,SUSE-2024-1534,SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-1534,SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-1534,SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-1534,SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-1534,SUSE-SLE-Product-SLES_SAP-15-SP2-2024-1534,SUSE-SLE-Product-SLES_SAP-15-SP3-2024-1534,SUSE-SUSE-MicroOS-5.1-2024-1534,SUSE-SUSE-MicroOS-5.2-2024-1534,SUSE-Storage-7.1-2024-1534 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20241534-1/ Link for SUSE-SU-2024:1534-1 https://lists.suse.com/pipermail/sle-updates/2024-May/035178.html E-Mail link for SUSE-SU-2024:1534-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1222849 SUSE Bug 1222849 https://www.suse.com/security/cve/CVE-2024-32487/ SUSE CVE CVE-2024-32487 page Container suse/sle-micro-rancher/5.2:latest Container suse/sle-micro/5.1/toolbox:latest Container suse/sle-micro/5.2/toolbox:latest Image SLES15-SP2-SAP-Azure-LI-BYOS-Production Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production Image SLES15-SP3-BYOS-Azure Image SLES15-SP3-BYOS-EC2-HVM Image SLES15-SP3-BYOS-GCE Image SLES15-SP3-CHOST-BYOS-Aliyun Image SLES15-SP3-CHOST-BYOS-Azure Image SLES15-SP3-CHOST-BYOS-EC2 Image SLES15-SP3-CHOST-BYOS-GCE Image SLES15-SP3-CHOST-BYOS-SAP-CCloud Image SLES15-SP3-HPC-BYOS-Azure Image SLES15-SP3-HPC-BYOS-EC2-HVM Image SLES15-SP3-HPC-BYOS-GCE Image SLES15-SP3-Micro-5-1-BYOS-Azure Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM Image SLES15-SP3-Micro-5-1-BYOS-GCE Image SLES15-SP3-Micro-5-2-BYOS-Azure Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM Image SLES15-SP3-Micro-5-2-BYOS-GCE Image SLES15-SP3-SAP-Azure-LI-BYOS-Production Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production Image SLES15-SP3-SAP-BYOS-Azure Image SLES15-SP3-SAP-BYOS-EC2-HVM Image SLES15-SP3-SAP-BYOS-GCE Image SLES15-SP3-SAPCAL-Azure Image SLES15-SP3-SAPCAL-EC2-HVM Image SLES15-SP3-SAPCAL-GCE SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 less-530-150000.3.9.1 less-530-150000.3.9.1 as a component of Container suse/sle-micro-rancher/5.2:latest less-530-150000.3.9.1 as a component of Container suse/sle-micro/5.1/toolbox:latest less-530-150000.3.9.1 as a component of Container suse/sle-micro/5.2/toolbox:latest less-530-150000.3.9.1 as a component of Image SLES15-SP2-SAP-Azure-LI-BYOS-Production less-530-150000.3.9.1 as a component of Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production less-530-150000.3.9.1 as a component of Image SLES15-SP3-BYOS-Azure less-530-150000.3.9.1 as a component of Image SLES15-SP3-BYOS-EC2-HVM less-530-150000.3.9.1 as a component of Image SLES15-SP3-BYOS-GCE less-530-150000.3.9.1 as a component of Image SLES15-SP3-CHOST-BYOS-Aliyun less-530-150000.3.9.1 as a component of Image SLES15-SP3-CHOST-BYOS-Azure less-530-150000.3.9.1 as a component of Image SLES15-SP3-CHOST-BYOS-EC2 less-530-150000.3.9.1 as a component of Image SLES15-SP3-CHOST-BYOS-GCE less-530-150000.3.9.1 as a component of Image SLES15-SP3-CHOST-BYOS-SAP-CCloud less-530-150000.3.9.1 as a component of Image SLES15-SP3-HPC-BYOS-Azure less-530-150000.3.9.1 as a component of Image SLES15-SP3-HPC-BYOS-EC2-HVM less-530-150000.3.9.1 as a component of Image SLES15-SP3-HPC-BYOS-GCE less-530-150000.3.9.1 as a component of Image SLES15-SP3-Micro-5-1-BYOS-Azure less-530-150000.3.9.1 as a component of Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM less-530-150000.3.9.1 as a component of Image SLES15-SP3-Micro-5-1-BYOS-GCE less-530-150000.3.9.1 as a component of Image SLES15-SP3-Micro-5-2-BYOS-Azure less-530-150000.3.9.1 as a component of Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM less-530-150000.3.9.1 as a component of Image SLES15-SP3-Micro-5-2-BYOS-GCE less-530-150000.3.9.1 as a component of Image SLES15-SP3-SAP-Azure-LI-BYOS-Production less-530-150000.3.9.1 as a component of Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production less-530-150000.3.9.1 as a component of Image SLES15-SP3-SAP-BYOS-Azure less-530-150000.3.9.1 as a component of Image SLES15-SP3-SAP-BYOS-EC2-HVM less-530-150000.3.9.1 as a component of Image SLES15-SP3-SAP-BYOS-GCE less-530-150000.3.9.1 as a component of Image SLES15-SP3-SAPCAL-Azure less-530-150000.3.9.1 as a component of Image SLES15-SP3-SAPCAL-EC2-HVM less-530-150000.3.9.1 as a component of Image SLES15-SP3-SAPCAL-GCE less-530-150000.3.9.1 as a component of SUSE Enterprise Storage 7.1 less-530-150000.3.9.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS less-530-150000.3.9.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS less-530-150000.3.9.1 as a component of SUSE Linux Enterprise Micro 5.1 less-530-150000.3.9.1 as a component of SUSE Linux Enterprise Micro 5.2 less-530-150000.3.9.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS less-530-150000.3.9.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS less-530-150000.3.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 less-530-150000.3.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases. CVE-2024-32487 Container suse/sle-micro-rancher/5.2:latest:less-530-150000.3.9.1 Container suse/sle-micro/5.1/toolbox:latest:less-530-150000.3.9.1 Container suse/sle-micro/5.2/toolbox:latest:less-530-150000.3.9.1 Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:less-530-150000.3.9.1 Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:less-530-150000.3.9.1 Image SLES15-SP3-BYOS-Azure:less-530-150000.3.9.1 Image SLES15-SP3-BYOS-EC2-HVM:less-530-150000.3.9.1 Image SLES15-SP3-BYOS-GCE:less-530-150000.3.9.1 Image SLES15-SP3-CHOST-BYOS-Aliyun:less-530-150000.3.9.1 Image SLES15-SP3-CHOST-BYOS-Azure:less-530-150000.3.9.1 Image SLES15-SP3-CHOST-BYOS-EC2:less-530-150000.3.9.1 Image SLES15-SP3-CHOST-BYOS-GCE:less-530-150000.3.9.1 Image SLES15-SP3-CHOST-BYOS-SAP-CCloud:less-530-150000.3.9.1 Image SLES15-SP3-HPC-BYOS-Azure:less-530-150000.3.9.1 Image SLES15-SP3-HPC-BYOS-EC2-HVM:less-530-150000.3.9.1 Image SLES15-SP3-HPC-BYOS-GCE:less-530-150000.3.9.1 Image SLES15-SP3-Micro-5-1-BYOS-Azure:less-530-150000.3.9.1 Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM:less-530-150000.3.9.1 Image SLES15-SP3-Micro-5-1-BYOS-GCE:less-530-150000.3.9.1 Image SLES15-SP3-Micro-5-2-BYOS-Azure:less-530-150000.3.9.1 Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM:less-530-150000.3.9.1 Image SLES15-SP3-Micro-5-2-BYOS-GCE:less-530-150000.3.9.1 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:less-530-150000.3.9.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:less-530-150000.3.9.1 Image SLES15-SP3-SAP-BYOS-Azure:less-530-150000.3.9.1 Image SLES15-SP3-SAP-BYOS-EC2-HVM:less-530-150000.3.9.1 Image SLES15-SP3-SAP-BYOS-GCE:less-530-150000.3.9.1 Image SLES15-SP3-SAPCAL-Azure:less-530-150000.3.9.1 Image SLES15-SP3-SAPCAL-EC2-HVM:less-530-150000.3.9.1 Image SLES15-SP3-SAPCAL-GCE:less-530-150000.3.9.1 SUSE Enterprise Storage 7.1:less-530-150000.3.9.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:less-530-150000.3.9.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:less-530-150000.3.9.1 SUSE Linux Enterprise Micro 5.1:less-530-150000.3.9.1 SUSE Linux Enterprise Micro 5.2:less-530-150000.3.9.1 SUSE Linux Enterprise Server 15 SP2-LTSS:less-530-150000.3.9.1 SUSE Linux Enterprise Server 15 SP3-LTSS:less-530-150000.3.9.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:less-530-150000.3.9.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:less-530-150000.3.9.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20241534-1/ https://www.suse.com/security/cve/CVE-2024-32487.html CVE-2024-32487 https://bugzilla.suse.com/1222849 SUSE Bug 1222849