#VU46148 Security restrictions bypass in LilyPond - CVE-2020-17353

Vulnerability identifier: #VU46148

Vulnerability risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-17353

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
LilyPond
Universal components / Libraries / Scripting languages

Vendor: LilyPond

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to application does not properly impose security restrictions on on embedded-ps and embedded-svg, when  -dsafe is used. A remote attacker can create a specially crafted PostScript file, pass it to the affected application, bypass imposed security restrictions and execute arbitrary code on the target system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

LilyPond: 2.10.1 - 2.21.4

---

External links
https://git.savannah.gnu.org/gitweb/?p=lilypond.git;a=commit;h=b84ea4740f3279516905c5db05f4074e777c16ff
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QG2JUV4UTIA27JUE6IZLCEFP5PYSFPF4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2JYMVLTPSNYS5F7TBHKIXUZZJIJAMRX/
https://www.debian.org/security/2020/dsa-4756

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.