PT-2020-6148 · Lilypond+2 · Lilypond+2

Faidon Liambotis · Published 2020-08-05 · Updated 2024-06-15 · CVE-2020-17353

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LilyPond versions 2.20.0 and earlier LilyPond versions 2.21.x through 2.21.4

Description The issue is related to a lack of restrictions on embedded-ps and embedded-svg when the -dsafe option is used. This can be exploited by including dangerous PostScript code, potentially allowing an attacker to execute arbitrary code.

Recommendations For LilyPond versions 2.20.0 and earlier, consider disabling the use of embedded-ps and embedded-svg until a patch is available. For LilyPond versions 2.21.x through 2.21.4, restrict the use of embedded-ps and embedded-svg to minimize the risk of exploitation. As a temporary workaround, avoid using the -dsafe option with embedded-ps and embedded-svg until the issue is resolved.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2020-2599

ALT-PU-2020-2877

ALT-PU-2021-1207

BDU:2021-03182

CVE-2020-17353

DSA-4756-1

MGASA-2020-0414

OPENSUSE-SU-2020:1453-1

OPENSUSE-SU-2020:1506-1

OPENSUSE-SU-2020_1453-1

OPENSUSE-SU-2024:11021-1

Affected Products

Alt Linux

Lilypond

Suse

References · 32

• https://nvd.nist.gov/vuln/detail/CVE-2020-17353 · Security Note
• https://osv.dev/vulnerability/MGASA-2020-0414 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-17353 · Vendor Advisory
• https://debian.org/security/2020/dsa-4756 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/W2JYMVLTPSNYS5F7TBHKIXUZZJIJAMRX · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4756-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1453-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QG2JUV4UTIA27JUE6IZLCEFP5PYSFPF4 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1506-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11021-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00076.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00064.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QG2JUV4UTIA27JUE6IZLCEFP5PYSFPF4 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-17353 · Security Note
• https://bdu.fstec.ru/vul/2021-03182 · Security Note