CVE-2020-17353
lilypond - security update
9.8
CRITICAL
CVSS 3.1
EPSS 2.4%
Description
scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.
How to fix CVE-2020-17353
To remediate CVE-2020-17353, upgrade the affected package to a fixed version below.
- Debian/lilypond—upgrade to 2.20.0-2 or later
- —upgrade to 2.19.81+really-2.18.2-13+deb10u1 or later
Is CVE-2020-17353 being exploited?
Low — EPSS is 2.4%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 2.20.0-2
- from 0, < 2.19.81+really-2.18.2-13+deb10u1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |