CVE-2018-10992

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before
launching the program specified by the BROWSER environment variable, which
allows remote attackers to conduct argument-injection attacks via a crafted
URL, as demonstrated by a --proxy-pac-file argument, because the GNU Guile
code uses the system Scheme procedure instead of the system* Scheme
procedure. NOTE: this vulnerability exists because of an incomplete fix for
CVE-2017-17523.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=898373&gt;