CVE-2020-17354
Fixed in a distro release EPSS <1%CVSS 8.6
LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a different file format. NOTE: in 2.24 and later versions, safe mode is removed, and the product no longer tries to block code execution when external files are used.
Products: lilypond
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | lilypond | 2.22.1-1 |
| Debian 13 | lilypond | 2.22.1-1 |
| Debian 14 | lilypond | 2.22.1-1 |
| SUSE Package Hub 15 SP4 | guile1 | 2.2.6-bp154.3.3.1 |
| SUSE Package Hub 15 SP4 | lilypond | 2.24.1-bp154.2.3.2 |
| Ubuntu 16.04 LTS | lilypond | no fix |
| Ubuntu 18.04 LTS | lilypond | no fix |
| Ubuntu 20.04 LTS | lilypond | no fix |
| openSUSE Leap 15.4 | guile1 | 2.2.6-bp154.3.3.1 |
| openSUSE Leap 15.4 | lilypond | 2.24.1-bp154.2.3.2 |