CVE-2020-17353 Code injection in n/a

Critical 9.8 Published 5 Aug 2020 Updated 4 Aug 2024

Attackers can execute arbitrary code via malicious PostScript or SVG in LilyPond files when the safe mode flag is enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2020-17353?

CVE-2020-17353 is a critical code injection vulnerability in Debian Debian Linux, published on 5 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.

Which versions are affected by CVE-2020-17353?

It affects 5 products.

Linux distribution packages (5)

`lilypond` SUSE:Package Hub 15 SP2	All versions	`2.20.0-bp152.2.5.6`
`lilypond` SUSE:Package Hub 15 SP2	All versions	`2.20.0-bp152.2.8.1`
`lilypond-doc` SUSE:Package Hub 15 SP2	All versions	`2.20.0-lp152.2.5.10`
`lilypond` openSUSE:Leap 15.2	All versions	`2.20.0-bp152.2.5.6`
`lilypond-doc` openSUSE:Leap 15.2	All versions	`2.20.0-lp152.2.5.10`

Products include Debian Debian Linux, Fedoraproject Fedora, Lilypond Lilypond, Opensuse Backports Sle, Opensuse Leap.

How do I fix CVE-2020-17353?

Apply the vendor's patch.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2020-17353 being exploited?

There is no known exploitation of CVE-2020-17353 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2020-17353, DSA-4756-1, GHSA-wg4f-3xq5-x79h, MGASA-2020-0414, UBUNTU-CVE-2020-17353, openSUSE-SU-2020:1453-1 and 1 more.