PT-2020-14077 · Tuxguitar+1 · Tuxguitar+1

Mmmds · Published 2020-06-23 · Updated 2024-06-15 · CVE-2020-14940

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TuxGuitar version 1.5.4

Description An issue was discovered in the io/gpx/GPXDocumentReader.java file, where misconfigured XML parsers lead to XXE (XML External Entity) attacks while loading GP6 (.gpx) and GP7 (.gp) tablature files.

Recommendations For TuxGuitar version 1.5.4, consider disabling the GPXDocumentReader function until a patch is available to prevent XXE attacks. Restrict the loading of GP6 and GP7 files to minimize the risk of exploitation.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2020-14940

OPENSUSE-SU-2024:13324-1

Affected Products

Debian

Tuxguitar

References · 14

• 🔥 https://logicaltrust.net/blog/2020/06/tuxguitar.html · Exploit
• 🔥 https://sourceforge.net/p/tuxguitar/bugs/126 · Exploit
• https://osv.dev/vulnerability/CVE-2020-14940 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14940 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-14940 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13324-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-14940 · Security Note
• https://ubuntu.com/security/CVE-2020-14940 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-14940 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-14940 · Vendor Advisory
• https://suse.com/security/cve/CVE-2020-14940 · Note
• https://suse.com/security/cve/CVE-2020-13940 · Note
• https://t.me/rnetsec/12707 · Telegram Post
• https://t.me/cvenotify/4590 · Telegram Post