USN-6756-1: less vulnerability
Severity
medium
Vendor
VMware Tanzu
Versions Affected
- Canonical Ubuntu 18.04
- Cflinuxfs3
- Cflinuxfs4
Description
It was discovered that less mishandled newline characters in file names. If a user or automated system were tricked into opening specially crafted files, an attacker could possibly use this issue to execute arbitrary commands on the host. Update Instructions: Run `sudo pro fix USN-6756-1` to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: less - 481-2.1ubuntu0.2+esm2 Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro.
Fixed VMware Products and Versions
- Cflinuxfs3
- 0.388.0 or greater
- Cfinuxfs4
- 1.96.0 or greater
- Jammy Stemcells
- 1.439 or greater
- Xenial Stemcells
- 621.944 or greater
- Platform Automation Toolkit
- 4.0.13 or greater
- 4.1.13 or greater
- 4.2.8 or greater
- 4.3.5 or greater
- Tanzu Greenplum for Kubernetes
- 2.0.0 or greater
- CF Deployment
- 30.0.0 or greater
- Operation Manager
- 2.10.74 or greater
- 3.0.28+LTS-T or greater
- Operations Manager Image
- 2.10.74 or greater
- 3.0.28+LTS-T or greater
References
https://ubuntu.com/security/notices/USN-6756-1
https://www.cloudfoundry.org/blog/usn-6756-1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=usn-6756-1
History
2024-04-29: Initial vulnerability report published.