The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact via malformed UTF-8 characters, which triggers an out-of-bounds read.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The is_utf8_well_formed function in GNU less before 475 allows remote attackers to have unspecified impact     via malformed UTF-8 characters, which triggers an out-of-bounds read. (CVE-2014-9488)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for less fixes the following issues :

Security issue fixed :

CVE-2014-9488: Malformed UTF-8 data could have caused an out of bounds read in the UTF-8 decoding routines, causing an invalid read access (bsc#921719).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the less package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - An out of bound read, with a maximum of 5 bytes, was     found in the way the is_utf8_well_formed() function     parsed UTF-8 characters. If less was to be recompiled     with an address sanitizer, a specially crafted input     could crash less.(CVE-2014-9488)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the less package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The is_utf8_well_formed function in GNU less before 475     allows remote attackers to have unspecified impact via     malformed UTF-8 characters, which triggers an     out-of-bounds     read.(backport-less-CVE-2014-9488-utf8-overflow.patch)

  - The is_utf8_well_formed function in GNU less before 475     allows remote attackers to have unspecified impact via     malformed UTF-8 characters, which triggers an     out-of-bounds read.(CVE-2014-9488)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the less package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - The is_utf8_well_formed function in GNU less before 475     allows remote attackers to have unspecified impact via     malformed UTF-8 characters, which triggers an     out-of-bounds read.(CVE-2014-9488)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the less package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The is_utf8_well_formed function in GNU less before 475     allows remote attackers to have unspecified impact via     malformed UTF-8 characters, which triggers an     out-of-bounds read.(CVE-2014-9488)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the less package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An out of bound read, with a maximum of 5 bytes, was     found in the way the is_utf8_well_formed() function     parsed UTF-8 characters. If less was to be recompiled     with an address sanitizer, a specially crafted input     could crash less.(CVE-2014-9488)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

better fix of out of bounds read access in is_utf8_well_formed() CVE-2014-9488 out of bounds read access in is_utf8_well_formed() CVE-2014-9488

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated less package fixes security vulnerability :

Malformed UTF-8 data could have caused an out of bounds read in the UTF-8 decoding routines, causing an invalid read access (CVE-2014-9488).

less was updated to fix one minor security issue :

Malformed UTF-8 data could have caused an out of bounds read in the UTF-8 decoding routines, causing an invalid read access. (bnc#921719) (CVE-2014-9488)

ID	Name	Product	Family	Type	Severity
218517	Linux Distros Unpatched Vulnerability : CVE-2014-9488	Nessus	Misc.	Local	critical
143693	SUSE SLES12 Security Update : less (SUSE-SU-2020:2687-1)	Nessus	SuSE Local Security Checks	Local	critical
141676	EulerOS Virtualization 3.0.2.2 : less (EulerOS-SA-2020-2212)	Nessus	Huawei Local Security Checks	Local	high
137989	EulerOS Virtualization 3.0.6.0 : less (EulerOS-SA-2020-1770)	Nessus	Huawei Local Security Checks	Local	critical
134527	EulerOS Virtualization for ARM 64 3.0.2.0 : less (EulerOS-SA-2020-1238)	Nessus	Huawei Local Security Checks	Local	critical
132137	EulerOS 2.0 SP3 : less (EulerOS-SA-2019-2602)	Nessus	Huawei Local Security Checks	Local	critical
131628	EulerOS 2.0 SP2 : less (EulerOS-SA-2019-2475)	Nessus	Huawei Local Security Checks	Local	critical
130873	EulerOS 2.0 SP5 : less (EulerOS-SA-2019-2164)	Nessus	Huawei Local Security Checks	Local	critical
84102	Fedora 21 : less-471-4.fc21 (2015-9325)	Nessus	Fedora Local Security Checks	Local	critical
84042	Fedora 22 : less-471-4.fc22 (2015-9357)	Nessus	Fedora Local Security Checks	Local	critical
82685	Mandriva Linux Security Advisory : less (MDVSA-2015:199)	Nessus	Mandriva Local Security Checks	Local	critical
82245	openSUSE Security Update : less (openSUSE-2015-260)	Nessus	SuSE Local Security Checks	Local	critical

Detections

Analytics

CVE-2014-9488

low

Tenable Plugins

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical