CVE-2020-17353 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2020-17353 Interim 1 15 2023-09-06T23:58:17Z current 2021-05-30T14:43:07Z 2023-09-06T23:58:17Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2020-17353 scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/opensuse-updates/2020-09/msg00182.html E-Mail link for openSUSE-SU-2020:1453-1 https://lists.opensuse.org/opensuse-updates/2020-09/msg00221.html E-Mail link for openSUSE-SU-2020:1506-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Package Hub 15 SP2 openSUSE Leap 15.2 openSUSE Tumbleweed lilypond-2.20.0-bp152.2.8.1 lilypond-2.20.0-lp152.2.5.10 lilypond-2.23.3-1.3 lilypond-doc-2.20.0-lp152.2.5.10 lilypond-doc-cs-2.20.0-lp152.2.5.10 lilypond-doc-de-2.20.0-lp152.2.5.10 lilypond-doc-es-2.20.0-lp152.2.5.10 lilypond-doc-fr-2.20.0-lp152.2.5.10 lilypond-doc-hu-2.20.0-lp152.2.5.10 lilypond-doc-it-2.20.0-lp152.2.5.10 lilypond-doc-ja-2.20.0-lp152.2.5.10 lilypond-doc-nl-2.20.0-lp152.2.5.10 lilypond-doc-zh-2.20.0-lp152.2.5.10 lilypond-emmentaler-fonts-2.20.0-bp152.2.8.1 lilypond-emmentaler-fonts-2.20.0-lp152.2.5.10 lilypond-emmentaler-fonts-2.23.3-1.3 lilypond-fonts-common-2.20.0-bp152.2.8.1 lilypond-fonts-common-2.20.0-lp152.2.5.10 lilypond-fonts-common-2.23.3-1.3 lilypond-texgy-fonts-2.20.0-bp152.2.8.1 lilypond-texgy-fonts-2.20.0-lp152.2.5.10 lilypond-texgy-fonts-2.23.3-1.3 lilypond-2.20.0-bp152.2.8.1 as a component of SUSE Package Hub 15 SP2 lilypond-doc-2.20.0-lp152.2.5.10 as a component of SUSE Package Hub 15 SP2 lilypond-doc-cs-2.20.0-lp152.2.5.10 as a component of SUSE Package Hub 15 SP2 lilypond-doc-de-2.20.0-lp152.2.5.10 as a component of SUSE Package Hub 15 SP2 lilypond-doc-es-2.20.0-lp152.2.5.10 as a component of SUSE Package Hub 15 SP2 lilypond-doc-fr-2.20.0-lp152.2.5.10 as a component of SUSE Package Hub 15 SP2 lilypond-doc-hu-2.20.0-lp152.2.5.10 as a component of SUSE Package Hub 15 SP2 lilypond-doc-it-2.20.0-lp152.2.5.10 as a component of SUSE Package Hub 15 SP2 lilypond-doc-ja-2.20.0-lp152.2.5.10 as a component of SUSE Package Hub 15 SP2 lilypond-doc-nl-2.20.0-lp152.2.5.10 as a component of SUSE Package Hub 15 SP2 lilypond-doc-zh-2.20.0-lp152.2.5.10 as a component of SUSE Package Hub 15 SP2 lilypond-emmentaler-fonts-2.20.0-bp152.2.8.1 as a component of SUSE Package Hub 15 SP2 lilypond-fonts-common-2.20.0-bp152.2.8.1 as a component of SUSE Package Hub 15 SP2 lilypond-texgy-fonts-2.20.0-bp152.2.8.1 as a component of SUSE Package Hub 15 SP2 lilypond-2.20.0-lp152.2.5.10 as a component of openSUSE Leap 15.2 lilypond-doc-2.20.0-lp152.2.5.10 as a component of openSUSE Leap 15.2 lilypond-doc-cs-2.20.0-lp152.2.5.10 as a component of openSUSE Leap 15.2 lilypond-doc-de-2.20.0-lp152.2.5.10 as a component of openSUSE Leap 15.2 lilypond-doc-es-2.20.0-lp152.2.5.10 as a component of openSUSE Leap 15.2 lilypond-doc-fr-2.20.0-lp152.2.5.10 as a component of openSUSE Leap 15.2 lilypond-doc-hu-2.20.0-lp152.2.5.10 as a component of openSUSE Leap 15.2 lilypond-doc-it-2.20.0-lp152.2.5.10 as a component of openSUSE Leap 15.2 lilypond-doc-ja-2.20.0-lp152.2.5.10 as a component of openSUSE Leap 15.2 lilypond-doc-nl-2.20.0-lp152.2.5.10 as a component of openSUSE Leap 15.2 lilypond-doc-zh-2.20.0-lp152.2.5.10 as a component of openSUSE Leap 15.2 lilypond-emmentaler-fonts-2.20.0-lp152.2.5.10 as a component of openSUSE Leap 15.2 lilypond-fonts-common-2.20.0-lp152.2.5.10 as a component of openSUSE Leap 15.2 lilypond-texgy-fonts-2.20.0-lp152.2.5.10 as a component of openSUSE Leap 15.2 lilypond-2.23.3-1.3 as a component of openSUSE Tumbleweed lilypond-emmentaler-fonts-2.23.3-1.3 as a component of openSUSE Tumbleweed lilypond-fonts-common-2.23.3-1.3 as a component of openSUSE Tumbleweed lilypond-texgy-fonts-2.23.3-1.3 as a component of openSUSE Tumbleweed scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code. CVE-2020-17353 SUSE Package Hub 15 SP2:lilypond-2.20.0-bp152.2.8.1 SUSE Package Hub 15 SP2:lilypond-doc-2.20.0-lp152.2.5.10 SUSE Package Hub 15 SP2:lilypond-doc-cs-2.20.0-lp152.2.5.10 SUSE Package Hub 15 SP2:lilypond-doc-de-2.20.0-lp152.2.5.10 SUSE Package Hub 15 SP2:lilypond-doc-es-2.20.0-lp152.2.5.10 SUSE Package Hub 15 SP2:lilypond-doc-fr-2.20.0-lp152.2.5.10 SUSE Package Hub 15 SP2:lilypond-doc-hu-2.20.0-lp152.2.5.10 SUSE Package Hub 15 SP2:lilypond-doc-it-2.20.0-lp152.2.5.10 SUSE Package Hub 15 SP2:lilypond-doc-ja-2.20.0-lp152.2.5.10 SUSE Package Hub 15 SP2:lilypond-doc-nl-2.20.0-lp152.2.5.10 SUSE Package Hub 15 SP2:lilypond-doc-zh-2.20.0-lp152.2.5.10 SUSE Package Hub 15 SP2:lilypond-emmentaler-fonts-2.20.0-bp152.2.8.1 SUSE Package Hub 15 SP2:lilypond-fonts-common-2.20.0-bp152.2.8.1 SUSE Package Hub 15 SP2:lilypond-texgy-fonts-2.20.0-bp152.2.8.1 openSUSE Leap 15.2:lilypond-2.20.0-lp152.2.5.10 openSUSE Leap 15.2:lilypond-doc-2.20.0-lp152.2.5.10 openSUSE Leap 15.2:lilypond-doc-cs-2.20.0-lp152.2.5.10 openSUSE Leap 15.2:lilypond-doc-de-2.20.0-lp152.2.5.10 openSUSE Leap 15.2:lilypond-doc-es-2.20.0-lp152.2.5.10 openSUSE Leap 15.2:lilypond-doc-fr-2.20.0-lp152.2.5.10 openSUSE Leap 15.2:lilypond-doc-hu-2.20.0-lp152.2.5.10 openSUSE Leap 15.2:lilypond-doc-it-2.20.0-lp152.2.5.10 openSUSE Leap 15.2:lilypond-doc-ja-2.20.0-lp152.2.5.10 openSUSE Leap 15.2:lilypond-doc-nl-2.20.0-lp152.2.5.10 openSUSE Leap 15.2:lilypond-doc-zh-2.20.0-lp152.2.5.10 openSUSE Leap 15.2:lilypond-emmentaler-fonts-2.20.0-lp152.2.5.10 openSUSE Leap 15.2:lilypond-fonts-common-2.20.0-lp152.2.5.10 openSUSE Leap 15.2:lilypond-texgy-fonts-2.20.0-lp152.2.5.10 openSUSE Tumbleweed:lilypond-2.23.3-1.3 openSUSE Tumbleweed:lilypond-emmentaler-fonts-2.23.3-1.3 openSUSE Tumbleweed:lilypond-fonts-common-2.23.3-1.3 openSUSE Tumbleweed:lilypond-texgy-fonts-2.23.3-1.3 critical 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H