CVE-2026-55543

TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive...

CVE-2026-55543

Versions of TuxGuitar prior to 2.1.0 are vulnerable to Arbitrary Code Execution when processing a maliciously crafted .tg file. An attacker can set the gervil.soundbank.path property to point to an on-disk archive (such as the .tg file itself) containing a META-INF/services/javax.sound.midi.Sound...

tuxguitar-2.1.0-1.1 on GA media (moderate)

tuxguitar-2.1.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11645-1 Rating: moderate Cross-References: CVE-2026-55543 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

OPENSUSE-SU-2026:11645-1 tuxguitar-2.1.0-1.1 on GA media

These are all security issues fixed in the tuxguitar-2.1.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-83609

Name of the Vulnerable Software and Affected Versions TuxGuitar versions prior to 2.1.0 Description An untrusted .tg file can manipulate the gervil.soundbank.path to reference an on-disk archive, such as the .tg file itself. If the archive contains a META-INF/services/javax.sound.midi.Soundbank...

EUVD-2010-3383

Malware in sbrugna...

EUVD-2020-7076

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2020-14940

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading to XXE while loading GP6 .gpx and GP7 .g...

OPENSUSE-SU-2024:13324-1 tuxguitar-1.6.0-2.1 on GA media

These are all security issues fixed in the tuxguitar-1.6.0-2.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2010-3385

TuxGuitar 1.2 places a zero-length directory name in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory...

CVE-2020-14940

An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading to XXE while loading GP6 .gpx and GP7 .gp tablature files...

CVE-2020-14940

An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading to XXE while loading GP6 .gpx and GP7 .gp tablature files...

Code injection

An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading to XXE while loading GP6 .gpx and GP7 .gp tablature files...

CVE-2020-14940

An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading to XXE while loading GP6 .gpx and GP7 .gp tablature files...

UBUNTU-CVE-2020-14940

An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading to XXE while loading GP6 .gpx and GP7 .gp tablature files...

CVE-2020-14940

An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading to XXE while loading GP6 .gpx and GP7 .gp tablature files...

CVE-2020-14940

CVE-2020-14940 affects TuxGuitar 1.5.4, specifically io/gpx/GPXDocumentReader.java, where misconfigured XML parsers cause an XXE when loading GP6 (.gpx) and GP7 (.gp) tablature files. Exploitation details or fixes are not provided in the connected documents; the NVD entry lists CVSSv3.1 base scor...

CVE-2020-14940

An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading to XXE while loading GP6 .gpx and GP7 .gp tablature files...

PT-2020-14077

Name of the Vulnerable Software and Affected Versions TuxGuitar version 1.5.4 Description An issue was discovered in the io/gpx/GPXDocumentReader.java file, where misconfigured XML parsers lead to XXE XML External Entity attacks while loading GP6 .gpx and GP7 .gp tablature files. Recommendations...

CVE-2020-14940: Improper Restriction of XML External Entity Reference

An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading to XXE while loading GP6 .gpx and GP7 .gp tablature files...