Severity

medium

Vendor

VMware Tanzu

Versions Affected

• Canonical Ubuntu 18.04

Description

It was discovered that less incorrectly handled certain file names. An attacker could possibly use this issue to cause a crash or execute arbitrary commands. Update Instructions: Run `sudo pro fix USN-6664-1` to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: less - 551-1ubuntu0.2 No subscription required.

Fixed VMware Products and Versions

• Cflinuxfs3
• 0.386.0 or greater
• Cflinuxfs4
• 1.77.0 or greater
• Jammy Stemcells
• 1.404 or greater
• Operations Manager Image
• 2.10.71 or greater
• 3.0.25+LTS-T or greater
• Platform Automation Toolkit
• 4.0.13 or greater
• 4.1.13 or greater
• 4.2.8 or greater
• 4.3.5 or greater
• Tanzu Greenplum for Kunbernetes
• 2.0.0 or greater
• Xenial Stemcells
• 621.897 or greater
• CF Deployment
• 30.0.0 or greater
• Isolation Segment
• 2.11.49 or greater
• 2.13.34 or greater
• 4.0.20+LTS-T or greater
• 5.0.10 or greater
• Operation Manager
• 2.10.71 or greater
• 3.0.25+LTS-T or greater
• VMware Tanzu Application Service for VMs
• 2.11.55 or greater
• 2.13.37 or greater
• 4.0.20+LTS-T or greater
• 5.0.10 or greater

References

https://ubuntu.com/security/notices/USN-6664-1

https://www.cloudfoundry.org/blog/usn-6664-1

https://cve.mitre.org/cgi-bin/cvename.cgi?name=usn-6664-1

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24676

History

2024-02-27: Initial vulnerability report published.