CVE-2020-17353
Fixed in a distro release EPSS 2%
scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.
Products: lilypond, fedoraproject fedora, debian_linux, opensuse backports_sle, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | lilypond | 2.19.81+really-2.18.2-13+deb10u1 |
| Debian 12 | lilypond | 2.20.0-2 |
| Debian 13 | lilypond | 2.20.0-2 |
| Debian 14 | lilypond | 2.20.0-2 |
| SUSE Package Hub 15 SP2 | lilypond | 2.20.0-bp152.2.8.1 |
| SUSE Package Hub 15 SP2 | lilypond | 2.20.0-bp152.2.5.6 |
| SUSE Package Hub 15 SP2 | lilypond-doc | 2.20.0-lp152.2.5.10 |
| Ubuntu 16.04 LTS | lilypond | no fix |
| Ubuntu 18.04 LTS | lilypond | no fix |
| Ubuntu 20.04 LTS | lilypond | no fix |
| openSUSE Leap 15.2 | lilypond | 2.20.0-bp152.2.5.6 |
| openSUSE Leap 15.2 | lilypond-doc | 2.20.0-lp152.2.5.10 |
| openSUSE Tumbleweed | lilypond | 2.23.3-1.3 |