{"id":"CVE-2022-46663","aliases":["ALSA-2023:3725","AZL-13350","BELL-CVE-2022-46663","DEBIAN-CVE-2022-46663","EUVD-2022-49459","GHSA-5xw7-xf7p-gm82","OESA-2023-1129","RHSA-2023:3725","RLSA-2023:3725","SUSE-SU-2023:0348-1","UBUNTU-CVE-2022-46663","USN-5848-1","openSUSE-SU-2024:12671-1"],"status":"published","title":"In GNU Less before 609, crafted data can result in \"less -R\" not filtering ANSI escape sequences...","description":"In GNU Less before 609, crafted data can result in \"less -R\" not filtering ANSI escape sequences sent to the terminal.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01412,"percentile":0.72887,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-02-07T00:00:00Z","modified":"2026-10-29T11:31:26Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"less","fixed_in":["590-2.el9_2"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"less","fixed_in":["590-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"less","fixed_in":["608-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"less","fixed_in":["590-1.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"less","fixed_in":["590-1.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"less","fixed_in":["590-1.2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"less","fixed_in":["590-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"less","fixed_in":["590-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"less","fixed_in":["590-4.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"less","fixed_in":["590-4.oe2203sp1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"less","fixed_in":["0:590-2.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"less-debuginfo","fixed_in":["0:590-2.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"less-debugsource","fixed_in":["0:590-2.el9_2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"less","fixed_in":["0:590-2.el9_2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"less","fixed_in":["590-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"less","fixed_in":["590-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"less","fixed_in":["590-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"less","fixed_in":["590-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"less","fixed_in":["590-1ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"less","fixed_in":["608-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"less","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"590-2.el9_2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"less","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"590-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"less","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"608-r0"},{"fixed":"608-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"less","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"590-1.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"less","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"590-1.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"less","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"590-1.2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"less","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"590-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"less","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"590-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"less","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"590-4.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"less","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"590-4.oe2203sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"less","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:590-2.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"less-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:590-2.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"less-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:590-2.el9_2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"less","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:590-2.el9_2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"less","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"590-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"less","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"590-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"less","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"590-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"less","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"590-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"less","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"590-1ubuntu0.22.04.1"}]}],"versions":["551-2","551-2build1","590-1","590-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"less","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"590-1ubuntu0.22.04.1"}]}],"versions":["551-2","551-2build1","590-1","590-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"less","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"608-2.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnu","product":"less"}],"references":[{"url":"https://github.com/gwsw/less/commit/a78e1351113cef564d790a730d657a321624d79c","tags":["x_transferred","Patch","fix","report"]},{"url":"http://www.greenwoodsoftware.com/less/news.609.html","tags":["x_transferred","Broken Link","web"]},{"url":"https://www.openwall.com/lists/oss-security/2023/02/07/7","tags":["x_transferred","Mailing List","Patch","Third Party Advisory","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2023/02/07/7","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LR7AUWB34JD4PCW3HHASBEDGGHFWPAQP/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/202310-11","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46663","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LR7AUWB34JD4PCW3HHASBEDGGHFWPAQP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LR7AUWB34JD4PCW3HHASBEDGGHFWPAQP"},{"url":"https://github.com/advisories/GHSA-5xw7-xf7p-gm82"},{"url":"https://access.redhat.com/errata/RHSA-2023:3725","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-46663","tags":["report"]},{"url":"https://bugzilla.redhat.com/2169621","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-3725.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-46663","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46663.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-46663","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1129","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2169621","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3725.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-46663","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2023:3725","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230348-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1207815","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46663","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-46663","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5848-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-46663","description":"In GNU Less before 609, crafted data can result in \"less -R\" not filtering ANSI escape sequences sent to the terminal.","status":"published","published":"2023-02-07T00:00:00Z","modified":"2025-03-25T14:40:07.637Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:34:31.840191Z"}],"euvd":[{"id":"EUVD-2022-49459","description":"In GNU Less before 609, crafted data can result in \"less -R\" not filtering ANSI escape sequences sent to the terminal.","status":"published","published":"2023-02-07T00:00:00Z","modified":"2025-03-25T14:40:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:53.129601Z"}],"ghsa":[{"id":"GHSA-5xw7-xf7p-gm82","title":"In GNU Less before 609, crafted data can result in \"less -R\" not filtering ANSI escape sequences...","description":"In GNU Less before 609, crafted data can result in \"less -R\" not filtering ANSI escape sequences sent to the terminal.","status":"published","published":"2023-02-07T21:30:22Z","modified":"2025-03-25T15:32:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:00:26.443231Z"}],"nvd":[{"id":"CVE-2022-46663","description":"In GNU Less before 609, crafted data can result in \"less -R\" not filtering ANSI escape sequences sent to the terminal.","status":"published","published":"2023-02-07T21:15:09.247Z","modified":"2026-06-17T05:12:09.65Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:07:36.026349Z"}],"osv":[{"id":"AZL-13350","title":"CVE-2022-46663 affecting package less for versions less than 590-2","description":"In GNU Less before 609, crafted data can result in \"less -R\" not filtering ANSI escape sequences sent to the terminal.","status":"published","published":"2023-02-07T21:15:09Z","modified":"2026-04-21T04:22:49.390709Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:02.666535Z"},{"id":"BELL-CVE-2022-46663","status":"published","published":"2023-02-07T21:15:00Z","modified":"2026-01-26T09:33:00.297519Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-46663","description":"In GNU Less before 609, crafted data can result in \"less -R\" not filtering ANSI escape sequences sent to the terminal.","status":"published","published":"2023-02-07T00:00:00Z","modified":"2026-10-28T10:36:02.664617256Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:27.481647Z"},{"id":"DEBIAN-CVE-2022-46663","description":"In GNU Less before 609, crafted data can result in \"less -R\" not filtering ANSI escape sequences sent to the terminal.","status":"published","published":"2023-02-07T21:15:09.247Z","modified":"2026-11-03T08:04:12.651807505Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:23:07.763774Z"},{"id":"OESA-2023-1129","title":"less security update","description":"Less is a pager. A pager is a program that displays text files.Other pagers commonly in use are more and pg. Pagers are often used in command-line environments like the Unix shell and the MS-DOS command prompt to display files.Less is not an editor. You can't change the contents of the file you're viewing. Less is not a windowing system. It doesn't have fancy scroll bars or other GUI (graphical user interface) elements.\r\n\r\nSecurity Fix(es):\r\n\r\nIn GNU Less before 609, crafted data can result in \u0026quot;less -R\u0026quot; not filtering ANSI escape sequences sent to the terminal.(CVE-2022-46663)","status":"published","published":"2023-02-24T11:05:36Z","modified":"2026-08-18T01:17:31.634478786Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2023:3725","title":"Red Hat Security Advisory: less security update","status":"published","published":"2024-09-16T11:57:25Z","modified":"2026-08-09T10:03:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RLSA-2023:3725","title":"Moderate: less security update","description":"The \"less\" utility is a text file browser that resembles \"more\", but allows users to move backwards in the file as well as forwards. Since \"less\" does not read the entire input file at startup, it also starts more quickly than ordinary text editors.\n\nSecurity Fix(es):\n\n* less: crafted data can result in \"less -R\" not filtering ANSI escape sequences sent to the terminal (CVE-2022-46663)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-08-31T16:55:39.127366Z","modified":"2026-02-04T23:15:05.286429Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2022-46663","description":"In GNU Less before 609, crafted data can result in \"less -R\" not filtering ANSI escape sequences sent to the terminal.","status":"published","published":"2023-02-07T09:00:00Z","modified":"2026-02-04T04:28:56.435532Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"ALSA-2023:3725","title":"Moderate: less security update","description":"The \"less\" utility is a text file browser that resembles \"more\", but allows users to move backwards in the file as well as forwards. Since \"less\" does not read the entire input file at startup, it also starts more quickly than ordinary text editors.\n\nSecurity Fix(es):\n\n* less: crafted data can result in \"less -R\" not filtering ANSI escape sequences sent to the terminal (CVE-2022-46663)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-06-21T00:00:00Z","modified":"2026-10-29T11:31:26.369385296Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"openSUSE-SU-2024:12671-1","title":"less-608-2.1 on GA media","description":"These are all security issues fixed in the less-608-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:14:29.852494Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2023:0348-1","title":"Security update for less","description":"This update for less fixes the following issues:\n\n  - CVE-2022-46663: Fixed denial-of-service by printing specially crafted escape sequences to the terminal (bsc#1207815).\n","status":"published","published":"2023-02-10T14:08:47Z","modified":"2026-02-04T04:30:09.944293Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"USN-5848-1","title":"less vulnerability","description":"David Leadbeater discovered that less was not properly handling escape\nsequences when displaying raw control characters. A maliciously formed\nOSC 8 hyperlink could possibly be used by an attacker to cause a denial of\nservice.\n","status":"published","published":"2023-02-09T05:45:43Z","modified":"2026-02-10T04:42:56Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}