Strix
26.1K

CVE-2020-17353

CRITICALCVSS 9.8/10EPSS 2.37%

Last modified

CVE-2020-17353 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.. EPSS estimates a 2.37% chance of exploitation in the next 30 days.

Description

scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
2.37%

81.7th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersionsUpdate
LilypondLilypond<= 2.20.0—
LilypondLilypond>= 2.21.0, <= 2.21.4—
FedoraprojectFedora31—
FedoraprojectFedora32—
DebianDebian Linux10.0—
OpensuseBackports Sle15.0Sp2
OpensuseLeap15.2—

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-17353?
scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.
How severe is CVE-2020-17353?
CVE-2020-17353 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 2.37% probability of exploitation in the next 30 days.
How do I fix CVE-2020-17353?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-17353?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST