Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2022-46663: In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal.
CVE-2022-46663 · published 3 years ago
Summary
In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal.
What to do
- Update debian less to version 590-1.2.
- Update gnu less to version 609 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | gnu | less |
>= 566, < 609 cpe:2.3:a:gnu:less:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
37 cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* |
| Debian:12 | debian | less |
< 590-1.2 Fix: upgrade to 590-1.2
|
Original advisory text
In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal.
In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal.
References
- http://www.greenwoodsoftware.com/less/news.609.html URL
- https://www.openwall.com/lists/oss-security/2023/02/07/7 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46663... Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-46663 Vendor Advisory
- https://security.gentoo.org/glsa/202310-11 Vendor Advisory
- https://github.com/gwsw/less/commit/a78e1351113cef564d790a730d657a321624d79c Patch
- http://www.openwall.com/lists/oss-security/2023/02/07/7 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2022-46663 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Timeline
Published7 Feb 2023
Updated4 Nov 2026
First seen29 Sep 2026
Track software like this
Free during beta