CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 1CVE-2020-17354
https://notcve.org/view.php?id=CVE-2020-17354
LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a different file format. NOTE: in 2.24 and later versions, safe mode is removed, and the product no longer tries to block code execution when external files are used. • http://lilypond.org/doc/v2.18/Documentation/usage/command_002dline-usage https://gitlab.com/lilypond/lilypond/-/merge_requests/1522 https://lilypond.org/download.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K43PF6VGFJNNGAPY57BW3VMEFFOSMRLF https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ST5BLLQ4GDME3SN7UE5OMNE5GZE66X4Y https://phabricator.wikimedia.org/T259210 https://tracker.debian.org/news/1249694/accepted-lilypond-2221-1-sou • CWE-863: Incorrect Authorization •
CVSS: 9.8EPSS: 0%CPEs: 7EXPL: 0CVE-2020-17353
https://notcve.org/view.php?id=CVE-2020-17353
scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code. El archivo scm/define-stencil-command.scm en LilyPond versiones hasta 2.20.0 y versiones 2.21.x hasta 2.21.4, cuando -dsafe es usada, carece de restricciones en embedded-ps y embedded-svg, como es demostrado al incluir código PostScript peligroso • http://git.savannah.gnu.org/gitweb/?p=lilypond.git%3Ba=commit%3Bh=b84ea4740f3279516905c5db05f4074e777c16ff http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00064.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00076.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QG2JUV4UTIA27JUE6IZLCEFP5PYSFPF4 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2JYMVLTPSNYS5F7TBHKIXUZZJIJAMRX https://www.debian.org/security/202 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-10992
https://notcve.org/view.php?id=CVE-2018-10992
lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument, because the GNU Guile code uses the system Scheme procedure instead of the system* Scheme procedure. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-17523. lilypond-invoke-editor en LilyPond en versiones anteriores a la 2.19.80 no valida cadenas antes de iniciar el programa especificado por la variable de entorno BROWSER. Esto permite que atacantes remotos lleven a cabo ataques de inyección de argumentos mediante una URL manipulada, tal y como demuestra un argumento --proxy-pac-file debido a que el código GNU Guile emplea el procedimiento system Scheme en lugar del procedimiento system* Scheme. NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2017-17523. • https://bugs.debian.org/898373 • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-17523
https://notcve.org/view.php?id=CVE-2017-17523
lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument. lilypond-invoke-editor en LilyPond en versiones anteriores a la 2.19.80 no valida cadenas antes de iniciar el programa especificado por la variable de entorno BROWSER. Esto permite que atacantes remotos lleven a cabo ataques de inyección de argumentos mediante una URL manipulada, tal y como demuestra un argumento --proxy-pac-file. • https://bugs.debian.org/881767 https://bugs.debian.org/884136 https://sourceforge.net/p/testlilyissues/issues/5243 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •