Описание
scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | ignored | end of standard support, was needed |
| devel | not-affected | 2.20.0-2 |
| esm-apps/bionic | needed | |
| esm-apps/focal | needed | |
| esm-apps/jammy | not-affected | 2.20.0-2 |
| esm-apps/noble | not-affected | 2.20.0-2 |
| esm-apps/xenial | needed | |
| esm-infra-legacy/trusty | DNE | |
| focal | ignored | end of standard support, was needed |
| groovy | ignored | end of life |
Показывать по
7.5 High
CVSS2
9.8 Critical
CVSS3
Связанные уязвимости
scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.
scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x ...
scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.
Уязвимость программы для набора партитур Lilypond, связанная с отсутствием ограничения включения команд Postscript и SVG при работе в безопасном режиме, позволяющая нарушителю выполнить произвольный код
7.5 High
CVSS2
9.8 Critical
CVSS3