CVE-2020-17354

Katalog CVE

CVSS 8.6 · High EPSS 0,41%

Kerentanan Incorrect Authorization pada lilypond. Skor CVSS 3.1 8.6 (High) menurut NVD.

Deskripsi (NVD)

LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a different file format. NOTE: in 2.24 and later versions, safe mode is removed, and the product no longer tries to block code execution when external files are used.

Rincian

Terbit di NVD

15 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.6 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitlab.com/lilypond/lilypond/-/merge_requests/1522 patch · advisory vendor
• https://phabricator.wikimedia.org/T259210 exploit · advisory pihak ketiga
• https://tracker.debian.org/news/1249694/accepted-lilypond-2221-1-source-into-unstable/ mailing list · release notes · advisory pihak ketiga
• https://www.mediawiki.org/wiki/Extension:Score/2021_security_advisory advisory pihak ketiga
• http://lilypond.org/doc/v2.18/Documentation/usage/command_002dline-usage release notes
• https://lilypond.org/download.html product
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K43PF6VGFJNNG...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ST5BLLQ4GDME3...