CVE-2004-2264: Format string bug in the open_altfile function in filename.c for GNU less 382, 381, and 358 might allow loc...

Security readout for executives and security teams

CVE-2004-2264 concerns old GNU less versions where a local user's LESSOPEN environment variable could crash less or possibly run code. The CVE itself notes less is not normally setuid or setgid, so practical business risk depends on whether less is invoked across a privilege boundary. Exposure is most plausible on legacy Unix-like systems still running GNU less 358, 381, or 382, especially where scripts, wrappers, terminals, or admin tooling invoke less while preserving untrusted LESSOPEN values. Treat this as a legacy hygiene issue, not an emergency, unless old less versions are used in privileged workflows. Prioritize confirmation on sensitive servers and decommission or update affected builds during normal patch cycles. Mitigation focus: Inventory systems for GNU less 358, 381, or 382.; Replace affected legacy less builds with vendor-supported packages per vendor guidance.; Do not run less through privileged wrappers that preserve untrusted environment variables..

Prepared

Jun 29, 2026, 18:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.