CVE-2020-17354 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2020-17354 Interim 1 3 2023-06-27T23:46:46Z current 2023-04-17T23:39:39Z 2023-06-27T23:46:46Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2020-17354 LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a different file format. NOTE: in 2.24 and later versions, safe mode is removed, and the product no longer tries to block code execution when external files are used. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ROLJCNPWZ2G4IQWP7NQKXNBT2QR32K2A/ E-Mail link for openSUSE-SU-2023:0137-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Package Hub 15 SP4 openSUSE Leap 15.4 guile1-2.2.6-bp154.3.3.1 guile1-modules-2_2-2.2.6-bp154.3.3.1 libguile-2_2-1-2.2.6-bp154.3.3.1 libguile1-devel-2.2.6-bp154.3.3.1 lilypond-2.24.1-bp154.2.3.2 lilypond-doc-2.24.1-bp154.2.3.2 lilypond-doc-cs-2.24.1-bp154.2.3.2 lilypond-doc-de-2.24.1-bp154.2.3.2 lilypond-doc-es-2.24.1-bp154.2.3.2 lilypond-doc-fr-2.24.1-bp154.2.3.2 lilypond-doc-hu-2.24.1-bp154.2.3.2 lilypond-doc-it-2.24.1-bp154.2.3.2 lilypond-doc-ja-2.24.1-bp154.2.3.2 lilypond-doc-nl-2.24.1-bp154.2.3.2 lilypond-doc-zh-2.24.1-bp154.2.3.2 lilypond-emmentaler-fonts-2.24.1-bp154.2.3.2 lilypond-fonts-common-2.24.1-bp154.2.3.2 guile1-2.2.6-bp154.3.3.1 as a component of SUSE Package Hub 15 SP4 guile1-modules-2_2-2.2.6-bp154.3.3.1 as a component of SUSE Package Hub 15 SP4 libguile-2_2-1-2.2.6-bp154.3.3.1 as a component of SUSE Package Hub 15 SP4 libguile1-devel-2.2.6-bp154.3.3.1 as a component of SUSE Package Hub 15 SP4 lilypond-2.24.1-bp154.2.3.2 as a component of SUSE Package Hub 15 SP4 lilypond-doc-2.24.1-bp154.2.3.2 as a component of SUSE Package Hub 15 SP4 lilypond-doc-cs-2.24.1-bp154.2.3.2 as a component of SUSE Package Hub 15 SP4 lilypond-doc-de-2.24.1-bp154.2.3.2 as a component of SUSE Package Hub 15 SP4 lilypond-doc-es-2.24.1-bp154.2.3.2 as a component of SUSE Package Hub 15 SP4 lilypond-doc-fr-2.24.1-bp154.2.3.2 as a component of SUSE Package Hub 15 SP4 lilypond-doc-hu-2.24.1-bp154.2.3.2 as a component of SUSE Package Hub 15 SP4 lilypond-doc-it-2.24.1-bp154.2.3.2 as a component of SUSE Package Hub 15 SP4 lilypond-doc-ja-2.24.1-bp154.2.3.2 as a component of SUSE Package Hub 15 SP4 lilypond-doc-nl-2.24.1-bp154.2.3.2 as a component of SUSE Package Hub 15 SP4 lilypond-doc-zh-2.24.1-bp154.2.3.2 as a component of SUSE Package Hub 15 SP4 lilypond-emmentaler-fonts-2.24.1-bp154.2.3.2 as a component of SUSE Package Hub 15 SP4 lilypond-fonts-common-2.24.1-bp154.2.3.2 as a component of SUSE Package Hub 15 SP4 guile1-2.2.6-bp154.3.3.1 as a component of openSUSE Leap 15.4 guile1-modules-2_2-2.2.6-bp154.3.3.1 as a component of openSUSE Leap 15.4 libguile-2_2-1-2.2.6-bp154.3.3.1 as a component of openSUSE Leap 15.4 libguile1-devel-2.2.6-bp154.3.3.1 as a component of openSUSE Leap 15.4 lilypond-2.24.1-bp154.2.3.2 as a component of openSUSE Leap 15.4 lilypond-doc-2.24.1-bp154.2.3.2 as a component of openSUSE Leap 15.4 lilypond-doc-cs-2.24.1-bp154.2.3.2 as a component of openSUSE Leap 15.4 lilypond-doc-de-2.24.1-bp154.2.3.2 as a component of openSUSE Leap 15.4 lilypond-doc-es-2.24.1-bp154.2.3.2 as a component of openSUSE Leap 15.4 lilypond-doc-fr-2.24.1-bp154.2.3.2 as a component of openSUSE Leap 15.4 lilypond-doc-hu-2.24.1-bp154.2.3.2 as a component of openSUSE Leap 15.4 lilypond-doc-it-2.24.1-bp154.2.3.2 as a component of openSUSE Leap 15.4 lilypond-doc-ja-2.24.1-bp154.2.3.2 as a component of openSUSE Leap 15.4 lilypond-doc-nl-2.24.1-bp154.2.3.2 as a component of openSUSE Leap 15.4 lilypond-doc-zh-2.24.1-bp154.2.3.2 as a component of openSUSE Leap 15.4 lilypond-emmentaler-fonts-2.24.1-bp154.2.3.2 as a component of openSUSE Leap 15.4 lilypond-fonts-common-2.24.1-bp154.2.3.2 as a component of openSUSE Leap 15.4 LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a different file format. NOTE: in 2.24 and later versions, safe mode is removed, and the product no longer tries to block code execution when external files are used. CVE-2020-17354 SUSE Package Hub 15 SP4:guile1-2.2.6-bp154.3.3.1 SUSE Package Hub 15 SP4:guile1-modules-2_2-2.2.6-bp154.3.3.1 SUSE Package Hub 15 SP4:libguile-2_2-1-2.2.6-bp154.3.3.1 SUSE Package Hub 15 SP4:libguile1-devel-2.2.6-bp154.3.3.1 SUSE Package Hub 15 SP4:lilypond-2.24.1-bp154.2.3.2 SUSE Package Hub 15 SP4:lilypond-doc-2.24.1-bp154.2.3.2 SUSE Package Hub 15 SP4:lilypond-doc-cs-2.24.1-bp154.2.3.2 SUSE Package Hub 15 SP4:lilypond-doc-de-2.24.1-bp154.2.3.2 SUSE Package Hub 15 SP4:lilypond-doc-es-2.24.1-bp154.2.3.2 SUSE Package Hub 15 SP4:lilypond-doc-fr-2.24.1-bp154.2.3.2 SUSE Package Hub 15 SP4:lilypond-doc-hu-2.24.1-bp154.2.3.2 SUSE Package Hub 15 SP4:lilypond-doc-it-2.24.1-bp154.2.3.2 SUSE Package Hub 15 SP4:lilypond-doc-ja-2.24.1-bp154.2.3.2 SUSE Package Hub 15 SP4:lilypond-doc-nl-2.24.1-bp154.2.3.2 SUSE Package Hub 15 SP4:lilypond-doc-zh-2.24.1-bp154.2.3.2 SUSE Package Hub 15 SP4:lilypond-emmentaler-fonts-2.24.1-bp154.2.3.2 SUSE Package Hub 15 SP4:lilypond-fonts-common-2.24.1-bp154.2.3.2 openSUSE Leap 15.4:guile1-2.2.6-bp154.3.3.1 openSUSE Leap 15.4:guile1-modules-2_2-2.2.6-bp154.3.3.1 openSUSE Leap 15.4:libguile-2_2-1-2.2.6-bp154.3.3.1 openSUSE Leap 15.4:libguile1-devel-2.2.6-bp154.3.3.1 openSUSE Leap 15.4:lilypond-2.24.1-bp154.2.3.2 openSUSE Leap 15.4:lilypond-doc-2.24.1-bp154.2.3.2 openSUSE Leap 15.4:lilypond-doc-cs-2.24.1-bp154.2.3.2 openSUSE Leap 15.4:lilypond-doc-de-2.24.1-bp154.2.3.2 openSUSE Leap 15.4:lilypond-doc-es-2.24.1-bp154.2.3.2 openSUSE Leap 15.4:lilypond-doc-fr-2.24.1-bp154.2.3.2 openSUSE Leap 15.4:lilypond-doc-hu-2.24.1-bp154.2.3.2 openSUSE Leap 15.4:lilypond-doc-it-2.24.1-bp154.2.3.2 openSUSE Leap 15.4:lilypond-doc-ja-2.24.1-bp154.2.3.2 openSUSE Leap 15.4:lilypond-doc-nl-2.24.1-bp154.2.3.2 openSUSE Leap 15.4:lilypond-doc-zh-2.24.1-bp154.2.3.2 openSUSE Leap 15.4:lilypond-emmentaler-fonts-2.24.1-bp154.2.3.2 openSUSE Leap 15.4:lilypond-fonts-common-2.24.1-bp154.2.3.2 important 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H