Security update for less SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:2060-1 Final 1 1 2024-06-18T11:11:48Z current 2024-06-18T11:11:48Z 2024-06-18T11:11:48Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for less This update for less fixes the following issues: - CVE-2024-32487: Fixed OS command injection via a newline character in the file name. (bsc#1222849) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container bci/bci-sle15-kernel-module-devel:15.7-2024-2060,Container bci/bci-sle15-kernel-module-devel:latest-2024-2060,Container bci/gcc:latest-2024-2060,Container bci/golang:1.22-openssl-2024-2060,Container bci/golang:1.23-2024-2060,Container bci/golang:latest-2024-2060,Container bci/kiwi:latest-2024-2060,Container bci/node:22-2024-2060,Container bci/nodejs:latest-2024-2060,Container bci/openjdk:17-2024-2060,Container bci/openjdk:latest-2024-2060,Container bci/python:3-2024-2060,Container bci/python:3.13-2024-2060,Container bci/python:latest-2024-2060,Container bci/ruby:3-2024-2060,Container bci/ruby:latest-2024-2060,Container bci/spack:0.23-2024-2060,Container bci/spack:latest-2024-2060,Container containers/python:3.11-2024-2060,Container containers/python:3.9-2024-2060,Container containers/pytorch:2-nvidia-2024-2060,Container containers/pytorch:2.5.0-2024-2060,Container suse/git:latest-2024-2060,Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest-2024-2060,Container suse/manager/5.0/x86_64/server:latest-2024-2060,Image SLES15-SP6-2024-2060,Image SLES15-SP6-Azure-Basic-2024-2060,Image SLES15-SP6-Azure-Standard-2024-2060,Image SLES15-SP6-BYOS-2024-2060,Image SLES15-SP6-BYOS-Azure-2024-2060,Image SLES15-SP6-BYOS-EC2-2024-2060,Image SLES15-SP6-BYOS-GCE-2024-2060,Image SLES15-SP6-CHOST-BYOS-2024-2060,Image SLES15-SP6-CHOST-BYOS-Aliyun-2024-2060,Image SLES15-SP6-CHOST-BYOS-Azure-2024-2060,Image SLES15-SP6-CHOST-BYOS-EC2-2024-2060,Image SLES15-SP6-CHOST-BYOS-GCE-2024-2060,Image SLES15-SP6-CHOST-BYOS-GDC-2024-2060,Image SLES15-SP6-CHOST-BYOS-SAP-CCloud-2024-2060,Image SLES15-SP6-EC2-2024-2060,Image SLES15-SP6-GCE-2024-2060,Image SLES15-SP6-HPC-2024-2060,Image SLES15-SP6-HPC-Azure-2024-2060,Image SLES15-SP6-HPC-BYOS-2024-2060,Image SLES15-SP6-HPC-BYOS-Azure-2024-2060,Image SLES15-SP6-HPC-BYOS-EC2-2024-2060,Image SLES15-SP6-HPC-BYOS-GCE-2024-2060,Image SLES15-SP6-HPC-EC2-2024-2060,Image SLES15-SP6-HPC-GCE-2024-2060,Image SLES15-SP6-Hardened-BYOS-2024-2060,Image SLES15-SP6-Hardened-BYOS-Azure-2024-2060,Image SLES15-SP6-Hardened-BYOS-EC2-2024-2060,Image SLES15-SP6-Hardened-BYOS-GCE-2024-2060,Image SLES15-SP6-SAP-2024-2060,Image SLES15-SP6-SAP-Azure-2024-2060,Image SLES15-SP6-SAP-Azure-LI-BYOS-2024-2060,Image SLES15-SP6-SAP-Azure-LI-BYOS-Production-2024-2060,Image SLES15-SP6-SAP-Azure-VLI-BYOS-2024-2060,Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production-2024-2060,Image SLES15-SP6-SAP-BYOS-2024-2060,Image SLES15-SP6-SAP-BYOS-Azure-2024-2060,Image SLES15-SP6-SAP-BYOS-EC2-2024-2060,Image SLES15-SP6-SAP-BYOS-GCE-2024-2060,Image SLES15-SP6-SAP-EC2-2024-2060,Image SLES15-SP6-SAP-GCE-2024-2060,Image SLES15-SP6-SAP-Hardened-2024-2060,Image SLES15-SP6-SAP-Hardened-Azure-2024-2060,Image SLES15-SP6-SAP-Hardened-BYOS-2024-2060,Image SLES15-SP6-SAP-Hardened-BYOS-Azure-2024-2060,Image SLES15-SP6-SAP-Hardened-BYOS-EC2-2024-2060,Image SLES15-SP6-SAP-Hardened-BYOS-GCE-2024-2060,Image SLES15-SP6-SAP-Hardened-EC2-2024-2060,Image SLES15-SP6-SAP-Hardened-GCE-2024-2060,Image SLES15-SP6-SAPCAL-2024-2060,Image SLES15-SP6-SAPCAL-Azure-2024-2060,Image SLES15-SP6-SAPCAL-EC2-2024-2060,Image SLES15-SP6-SAPCAL-GCE-2024-2060,Image ai_15_6-2024-2060,Image python_15_6-2024-2060,Image server-image-2024-2060,SUSE-2024-2060,SUSE-SLE-Module-Basesystem-15-SP6-2024-2060,openSUSE-SLE-15.6-2024-2060 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20242060-1/ Link for SUSE-SU-2024:2060-1 https://lists.suse.com/pipermail/sle-updates/2024-June/035617.html E-Mail link for SUSE-SU-2024:2060-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1222849 SUSE Bug 1222849 https://www.suse.com/security/cve/CVE-2024-32487/ SUSE CVE CVE-2024-32487 page Container bci/bci-sle15-kernel-module-devel:15.7 Container bci/bci-sle15-kernel-module-devel:latest Container bci/gcc:latest Container bci/golang:1.22-openssl Container bci/golang:1.23 Container bci/golang:latest Container bci/kiwi:latest Container bci/node:22 Container bci/nodejs:latest Container bci/openjdk:17 Container bci/openjdk:latest Container bci/python:3 Container bci/python:3.13 Container bci/python:latest Container bci/ruby:3 Container bci/ruby:latest Container bci/spack:0.23 Container bci/spack:latest Container containers/python:3.11 Container containers/python:3.9 Container containers/pytorch:2-nvidia Container containers/pytorch:2.5.0 Container suse/git:latest Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest Container suse/manager/5.0/x86_64/server:latest Image SLES15-SP6 Image SLES15-SP6-Azure-Basic Image SLES15-SP6-Azure-Standard Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-GCE Image SLES15-SP6-HPC Image SLES15-SP6-HPC-Azure Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-Azure-LI-BYOS Image SLES15-SP6-SAP-Azure-LI-BYOS-Production Image SLES15-SP6-SAP-Azure-VLI-BYOS Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production Image SLES15-SP6-SAP-BYOS Image SLES15-SP6-SAP-BYOS-Azure Image SLES15-SP6-SAP-BYOS-EC2 Image SLES15-SP6-SAP-BYOS-GCE Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAP-Hardened Image SLES15-SP6-SAP-Hardened-Azure Image SLES15-SP6-SAP-Hardened-BYOS Image SLES15-SP6-SAP-Hardened-BYOS-Azure Image SLES15-SP6-SAP-Hardened-BYOS-EC2 Image SLES15-SP6-SAP-Hardened-BYOS-GCE Image SLES15-SP6-SAP-Hardened-EC2 Image SLES15-SP6-SAP-Hardened-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Image ai_15_6 Image python_15_6 Image server-image SUSE Linux Enterprise Module for Basesystem 15 SP6 openSUSE Leap 15.6 less-643-150600.3.3.1 less-643-150600.3.3.1 as a component of Container bci/bci-sle15-kernel-module-devel:15.7 less-643-150600.3.3.1 as a component of Container bci/bci-sle15-kernel-module-devel:latest less-643-150600.3.3.1 as a component of Container bci/gcc:latest less-643-150600.3.3.1 as a component of Container bci/golang:1.22-openssl less-643-150600.3.3.1 as a component of Container bci/golang:1.23 less-643-150600.3.3.1 as a component of Container bci/golang:latest less-643-150600.3.3.1 as a component of Container bci/kiwi:latest less-643-150600.3.3.1 as a component of Container bci/node:22 less-643-150600.3.3.1 as a component of Container bci/nodejs:latest less-643-150600.3.3.1 as a component of Container bci/openjdk:17 less-643-150600.3.3.1 as a component of Container bci/openjdk:latest less-643-150600.3.3.1 as a component of Container bci/python:3 less-643-150600.3.3.1 as a component of Container bci/python:3.13 less-643-150600.3.3.1 as a component of Container bci/python:latest less-643-150600.3.3.1 as a component of Container bci/ruby:3 less-643-150600.3.3.1 as a component of Container bci/ruby:latest less-643-150600.3.3.1 as a component of Container bci/spack:0.23 less-643-150600.3.3.1 as a component of Container bci/spack:latest less-643-150600.3.3.1 as a component of Container containers/python:3.11 less-643-150600.3.3.1 as a component of Container containers/python:3.9 less-643-150600.3.3.1 as a component of Container containers/pytorch:2-nvidia less-643-150600.3.3.1 as a component of Container containers/pytorch:2.5.0 less-643-150600.3.3.1 as a component of Container suse/git:latest less-643-150600.3.3.1 as a component of Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest less-643-150600.3.3.1 as a component of Container suse/manager/5.0/x86_64/server:latest less-643-150600.3.3.1 as a component of Image SLES15-SP6 less-643-150600.3.3.1 as a component of Image SLES15-SP6-Azure-Basic less-643-150600.3.3.1 as a component of Image SLES15-SP6-Azure-Standard less-643-150600.3.3.1 as a component of Image SLES15-SP6-BYOS less-643-150600.3.3.1 as a component of Image SLES15-SP6-BYOS-Azure less-643-150600.3.3.1 as a component of Image SLES15-SP6-BYOS-EC2 less-643-150600.3.3.1 as a component of Image SLES15-SP6-BYOS-GCE less-643-150600.3.3.1 as a component of Image SLES15-SP6-CHOST-BYOS less-643-150600.3.3.1 as a component of Image SLES15-SP6-CHOST-BYOS-Aliyun less-643-150600.3.3.1 as a component of Image SLES15-SP6-CHOST-BYOS-Azure less-643-150600.3.3.1 as a component of Image SLES15-SP6-CHOST-BYOS-EC2 less-643-150600.3.3.1 as a component of Image SLES15-SP6-CHOST-BYOS-GCE less-643-150600.3.3.1 as a component of Image SLES15-SP6-CHOST-BYOS-GDC less-643-150600.3.3.1 as a component of Image SLES15-SP6-CHOST-BYOS-SAP-CCloud less-643-150600.3.3.1 as a component of Image SLES15-SP6-EC2 less-643-150600.3.3.1 as a component of Image SLES15-SP6-GCE less-643-150600.3.3.1 as a component of Image SLES15-SP6-HPC less-643-150600.3.3.1 as a component of Image SLES15-SP6-HPC-Azure less-643-150600.3.3.1 as a component of Image SLES15-SP6-HPC-BYOS less-643-150600.3.3.1 as a component of Image SLES15-SP6-HPC-BYOS-Azure less-643-150600.3.3.1 as a component of Image SLES15-SP6-HPC-BYOS-EC2 less-643-150600.3.3.1 as a component of Image SLES15-SP6-HPC-BYOS-GCE less-643-150600.3.3.1 as a component of Image SLES15-SP6-HPC-EC2 less-643-150600.3.3.1 as a component of Image SLES15-SP6-HPC-GCE less-643-150600.3.3.1 as a component of Image SLES15-SP6-Hardened-BYOS less-643-150600.3.3.1 as a component of Image SLES15-SP6-Hardened-BYOS-Azure less-643-150600.3.3.1 as a component of Image SLES15-SP6-Hardened-BYOS-EC2 less-643-150600.3.3.1 as a component of Image SLES15-SP6-Hardened-BYOS-GCE less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAP less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAP-Azure less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAP-Azure-LI-BYOS less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAP-Azure-LI-BYOS-Production less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAP-Azure-VLI-BYOS less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAP-BYOS less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAP-BYOS-Azure less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAP-BYOS-EC2 less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAP-BYOS-GCE less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAP-EC2 less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAP-GCE less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAP-Hardened less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAP-Hardened-Azure less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAP-Hardened-BYOS less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAP-Hardened-BYOS-Azure less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAP-Hardened-BYOS-EC2 less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAP-Hardened-BYOS-GCE less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAP-Hardened-EC2 less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAP-Hardened-GCE less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAPCAL less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAPCAL-Azure less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAPCAL-EC2 less-643-150600.3.3.1 as a component of Image SLES15-SP6-SAPCAL-GCE less-643-150600.3.3.1 as a component of Image ai_15_6 less-643-150600.3.3.1 as a component of Image python_15_6 less-643-150600.3.3.1 as a component of Image server-image less-643-150600.3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 less-643-150600.3.3.1 as a component of openSUSE Leap 15.6 less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases. CVE-2024-32487 Container bci/bci-sle15-kernel-module-devel:15.7:less-643-150600.3.3.1 Container bci/bci-sle15-kernel-module-devel:latest:less-643-150600.3.3.1 Container bci/gcc:latest:less-643-150600.3.3.1 Container bci/golang:1.22-openssl:less-643-150600.3.3.1 Container bci/golang:1.23:less-643-150600.3.3.1 Container bci/golang:latest:less-643-150600.3.3.1 Container bci/kiwi:latest:less-643-150600.3.3.1 Container bci/node:22:less-643-150600.3.3.1 Container bci/nodejs:latest:less-643-150600.3.3.1 Container bci/openjdk:17:less-643-150600.3.3.1 Container bci/openjdk:latest:less-643-150600.3.3.1 Container bci/python:3.13:less-643-150600.3.3.1 Container bci/python:3:less-643-150600.3.3.1 Container bci/python:latest:less-643-150600.3.3.1 Container bci/ruby:3:less-643-150600.3.3.1 Container bci/ruby:latest:less-643-150600.3.3.1 Container bci/spack:0.23:less-643-150600.3.3.1 Container bci/spack:latest:less-643-150600.3.3.1 Container containers/python:3.11:less-643-150600.3.3.1 Container containers/python:3.9:less-643-150600.3.3.1 Container containers/pytorch:2-nvidia:less-643-150600.3.3.1 Container containers/pytorch:2.5.0:less-643-150600.3.3.1 Container suse/git:latest:less-643-150600.3.3.1 Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest:less-643-150600.3.3.1 Container suse/manager/5.0/x86_64/server:latest:less-643-150600.3.3.1 Image SLES15-SP6-Azure-Basic:less-643-150600.3.3.1 Image SLES15-SP6-Azure-Standard:less-643-150600.3.3.1 Image SLES15-SP6-BYOS-Azure:less-643-150600.3.3.1 Image SLES15-SP6-BYOS-EC2:less-643-150600.3.3.1 Image SLES15-SP6-BYOS-GCE:less-643-150600.3.3.1 Image SLES15-SP6-BYOS:less-643-150600.3.3.1 Image SLES15-SP6-CHOST-BYOS-Aliyun:less-643-150600.3.3.1 Image SLES15-SP6-CHOST-BYOS-Azure:less-643-150600.3.3.1 Image SLES15-SP6-CHOST-BYOS-EC2:less-643-150600.3.3.1 Image SLES15-SP6-CHOST-BYOS-GCE:less-643-150600.3.3.1 Image SLES15-SP6-CHOST-BYOS-GDC:less-643-150600.3.3.1 Image SLES15-SP6-CHOST-BYOS-SAP-CCloud:less-643-150600.3.3.1 Image SLES15-SP6-CHOST-BYOS:less-643-150600.3.3.1 Image SLES15-SP6-EC2:less-643-150600.3.3.1 Image SLES15-SP6-GCE:less-643-150600.3.3.1 Image SLES15-SP6-HPC-Azure:less-643-150600.3.3.1 Image SLES15-SP6-HPC-BYOS-Azure:less-643-150600.3.3.1 Image SLES15-SP6-HPC-BYOS-EC2:less-643-150600.3.3.1 Image SLES15-SP6-HPC-BYOS-GCE:less-643-150600.3.3.1 Image SLES15-SP6-HPC-BYOS:less-643-150600.3.3.1 Image SLES15-SP6-HPC-EC2:less-643-150600.3.3.1 Image SLES15-SP6-HPC-GCE:less-643-150600.3.3.1 Image SLES15-SP6-HPC:less-643-150600.3.3.1 Image SLES15-SP6-Hardened-BYOS-Azure:less-643-150600.3.3.1 Image SLES15-SP6-Hardened-BYOS-EC2:less-643-150600.3.3.1 Image SLES15-SP6-Hardened-BYOS-GCE:less-643-150600.3.3.1 Image SLES15-SP6-Hardened-BYOS:less-643-150600.3.3.1 Image SLES15-SP6-SAP-Azure-LI-BYOS-Production:less-643-150600.3.3.1 Image SLES15-SP6-SAP-Azure-LI-BYOS:less-643-150600.3.3.1 Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production:less-643-150600.3.3.1 Image SLES15-SP6-SAP-Azure-VLI-BYOS:less-643-150600.3.3.1 Image SLES15-SP6-SAP-Azure:less-643-150600.3.3.1 Image SLES15-SP6-SAP-BYOS-Azure:less-643-150600.3.3.1 Image SLES15-SP6-SAP-BYOS-EC2:less-643-150600.3.3.1 Image SLES15-SP6-SAP-BYOS-GCE:less-643-150600.3.3.1 Image SLES15-SP6-SAP-BYOS:less-643-150600.3.3.1 Image SLES15-SP6-SAP-EC2:less-643-150600.3.3.1 Image SLES15-SP6-SAP-GCE:less-643-150600.3.3.1 Image SLES15-SP6-SAP-Hardened-Azure:less-643-150600.3.3.1 Image SLES15-SP6-SAP-Hardened-BYOS-Azure:less-643-150600.3.3.1 Image SLES15-SP6-SAP-Hardened-BYOS-EC2:less-643-150600.3.3.1 Image SLES15-SP6-SAP-Hardened-BYOS-GCE:less-643-150600.3.3.1 Image SLES15-SP6-SAP-Hardened-BYOS:less-643-150600.3.3.1 Image SLES15-SP6-SAP-Hardened-EC2:less-643-150600.3.3.1 Image SLES15-SP6-SAP-Hardened-GCE:less-643-150600.3.3.1 Image SLES15-SP6-SAP-Hardened:less-643-150600.3.3.1 Image SLES15-SP6-SAP:less-643-150600.3.3.1 Image SLES15-SP6-SAPCAL-Azure:less-643-150600.3.3.1 Image SLES15-SP6-SAPCAL-EC2:less-643-150600.3.3.1 Image SLES15-SP6-SAPCAL-GCE:less-643-150600.3.3.1 Image SLES15-SP6-SAPCAL:less-643-150600.3.3.1 Image SLES15-SP6:less-643-150600.3.3.1 Image ai_15_6:less-643-150600.3.3.1 Image python_15_6:less-643-150600.3.3.1 Image server-image:less-643-150600.3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP6:less-643-150600.3.3.1 openSUSE Leap 15.6:less-643-150600.3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20242060-1/ https://www.suse.com/security/cve/CVE-2024-32487.html CVE-2024-32487 https://bugzilla.suse.com/1222849 SUSE Bug 1222849