CVE-2020-17354

2023-04-1522:15:06

Google

osv.dev

lilypond

cve-2020-17354

arbitrary code execution

software

protection mechanism

scheme code

9.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.4%

JSON

LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a different file format. NOTE: in 2.24 and later versions, safe mode is removed, and the product no longer tries to block code execution when external files are used.

CPENameOperatorVersion
lilypondeqrelease/2.19.8-1
lilypondeqrelease/1.3.72
lilypondeqrelease/2.11.64-1
lilypondeqrelease/2.11.58-1
lilypondeqrelease/2.7.3
lilypondeqrelease/1.3.62
lilypondeqrelease/1.7.15
lilypondeqrelease/1.3.18
lilypondeqrelease/1.3.64
lilypondeqrelease/1.5.48

Name	Operator	Version
lilypond	eq	release/2.19.8-1
lilypond	eq	release/1.3.72
lilypond	eq	release/2.11.64-1
lilypond	eq	release/2.11.58-1
lilypond	eq	release/2.7.3
lilypond	eq	release/1.3.62
lilypond	eq	release/1.7.15
lilypond	eq	release/1.3.18
lilypond	eq	release/1.3.64
lilypond	eq	release/1.5.48