PT-2023-11479 · Lilypond+2 · Lilypond+2

Tstarling · Published 2023-04-15 · Updated 2025-11-19 · CVE-2020-17354

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LilyPond versions prior to 2.24

Description The issue allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a different file format. In versions 2.24 and later, safe mode is removed, and the product no longer tries to block code execution when external files are used.

Recommendations For versions prior to 2.24, update to version 2.24 or later, as safe mode is removed in these versions and the product no longer tries to block code execution when external files are used. As a temporary workaround, consider avoiding the use of output-def-lookup and output-def-scope until the issue is resolved.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

ALT-PU-2023-6382

ALT-PU-2023-6513

ALT-PU-2025-14667

CVE-2020-17354

MGASA-2023-0325

OPENSUSE-SU-2023:0137-1

Affected Products

Alt Linux

Debian

Lilypond

References · 33

• 🔥 https://phabricator.wikimedia.org/T259210 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2023:0137-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-17354 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ST5BLLQ4GDME3SN7UE5OMNE5GZE66X4Y · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-17354 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0325 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17354 · Security Note
• https://errata.altlinux.org/ALT-PU-2023-6382 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-17354 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K43PF6VGFJNNGAPY57BW3VMEFFOSMRLF · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/lilypond · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-17354 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-17354 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-17354 · Vendor Advisory
• https://gitlab.com/lilypond/lilypond/-/merge_requests/1522 · Vendor Advisory