GNU less 'is_utf8_well_formed()' Function Remote Buffer Overflow Vulnerability

Bugtraq ID:	74159
Class:	Boundary Condition Error
CVE:	CVE-2014-9488
Remote:	Yes
Local:	No
Published:	Apr 15 2015 12:00AM
Updated:	Apr 15 2015 12:00AM
Credit:	David Walser
Vulnerable:	S.u.S.E. openSUSE 13.2 S.u.S.E. openSUSE 13.1 Mageia Mageia 4 GNU Less 474
Not Vulnerable:	GNU Less 475

GNU less 'is_utf8_well_formed()' Function Remote Buffer Overflow Vulnerability

GNU less is prone to a buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts may crash the application, denying service to legitimate users.

GNU less 'is_utf8_well_formed()' Function Remote Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

GNU less 'is_utf8_well_formed()' Function Remote Buffer Overflow Vulnerability

References:

• less invalid memory access fixed (CVE-2014-9488) (Hanno Böck)
  
• Bug 15567 - less new security issue CVE-2014-9488 (Mageia Bugzilla)
  
• GNU less Homepage (GNU)
  
• Updated less packages fix CVE-2014-9488 (Mageia)