CVE catalog
CVE-2004-2264
less: CVE-2004-2264
- Severity
- Low
- Source
- [NVD] · [CVE record]
- EPSS
- 2.03% · Oct 25, 2026
Format string bug in the open_altfile function in filename.c for GNU less 382, 381, and 358 might allow local users to cause a denial of service or possibly execute arbitrary code via format strings in the LESSOPEN environment variable. NOTE: since less is not setuid or setgid, then this is not a vulnerability unless there are plausible scenarios under which privilege boundaries could be crossed
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | less | sid | 710+really668-1 | not affected |
| Debian | less | forky | 710+really668-1 | not affected |
| Debian | less | trixie | 668-1 | not affected |
| Debian | less | bookworm | 590-2.1~deb12u2 | not affected |
| Debian | less | bookworm-security | 590-2.1~deb12u2 | not affected |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | less | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | less | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | less | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | less | source | bookworm | Not affected | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [less]Not affected
Details (4)
590-2.1~deb12u2· amd64 · bookwormNot affected
dsa · less · debian · bookworm
590-2.1~deb12u2· arm64 · bookwormNot affected
dsa · less · debian · bookworm
590-2.1~deb12u2· amd64 · bookworm-securityNot affected
dsa · less · debian · bookworm
590-2.1~deb12u2· arm64 · bookworm-securityNot affected
dsa · less · debian · bookworm
Observed: