{"id":"UBUNTU-CVE-2020-14940","details":"An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading to XXE while loading GP6 (.gpx) and GP7 (.gp) tablature files.","modified":"2026-05-20T16:06:21.285196269Z","published":"2020-06-23T10:15:00Z","upstream":["CVE-2020-14940"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2020-14940"},{"type":"REPORT","url":"https://logicaltrust.net/blog/2020/06/tuxguitar.html"},{"type":"REPORT","url":"https://sourceforge.net/p/tuxguitar/bugs/126/"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2020-14940"}],"affected":[{"package":{"name":"tuxguitar","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/tuxguitar?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-20build1","1.2-21"],"ecosystem_specific":{"binaries":[{"binary_name":"tuxguitar","binary_version":"1.2-21"},{"binary_name":"tuxguitar-alsa","binary_version":"1.2-21"},{"binary_version":"1.2-21","binary_name":"tuxguitar-fluidsynth"},{"binary_name":"tuxguitar-jack","binary_version":"1.2-21"},{"binary_version":"1.2-21","binary_name":"tuxguitar-jsa"},{"binary_name":"tuxguitar-oss","binary_version":"1.2-21"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-14940.json"}},{"package":{"name":"tuxguitar","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/tuxguitar?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-22","1.2-23"],"ecosystem_specific":{"binaries":[{"binary_version":"1.2-23","binary_name":"tuxguitar"},{"binary_name":"tuxguitar-alsa","binary_version":"1.2-23"},{"binary_version":"1.2-23","binary_name":"tuxguitar-fluidsynth"},{"binary_name":"tuxguitar-jack","binary_version":"1.2-23"},{"binary_version":"1.2-23","binary_name":"tuxguitar-jsa"},{"binary_name":"tuxguitar-oss","binary_version":"1.2-23"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-14940.json"}},{"package":{"name":"tuxguitar","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/tuxguitar?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-23","1.2-24","1.2-24ubuntu1","1.2-25","1.2-25build1"],"ecosystem_specific":{"binaries":[{"binary_name":"tuxguitar","binary_version":"1.2-25build1"},{"binary_name":"tuxguitar-alsa","binary_version":"1.2-25build1"},{"binary_version":"1.2-25build1","binary_name":"tuxguitar-fluidsynth"},{"binary_name":"tuxguitar-jack","binary_version":"1.2-25build1"},{"binary_name":"tuxguitar-jsa","binary_version":"1.2-25build1"},{"binary_name":"tuxguitar-oss","binary_version":"1.2-25build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-14940.json"}},{"package":{"name":"tuxguitar","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/tuxguitar?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-25build1","1.2-25build2"],"ecosystem_specific":{"binaries":[{"binary_name":"tuxguitar","binary_version":"1.2-25build2"},{"binary_version":"1.2-25build2","binary_name":"tuxguitar-alsa"},{"binary_name":"tuxguitar-fluidsynth","binary_version":"1.2-25build2"},{"binary_version":"1.2-25build2","binary_name":"tuxguitar-jack"},{"binary_version":"1.2-25build2","binary_name":"tuxguitar-jsa"},{"binary_name":"tuxguitar-oss","binary_version":"1.2-25build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-14940.json"}},{"package":{"name":"tuxguitar","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/tuxguitar?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.6+dfsg1-6","1.5.6+dfsg1-7","1.5.6+dfsg1-8","1.5.6+dfsg1-8build2","1.5.6+dfsg1-8build3"],"ecosystem_specific":{"binaries":[{"binary_version":"1.5.6+dfsg1-8build3","binary_name":"tuxguitar"},{"binary_name":"tuxguitar-alsa","binary_version":"1.5.6+dfsg1-8build3"},{"binary_name":"tuxguitar-fluidsynth","binary_version":"1.5.6+dfsg1-8build3"},{"binary_name":"tuxguitar-jack","binary_version":"1.5.6+dfsg1-8build3"},{"binary_version":"1.5.6+dfsg1-8build3","binary_name":"tuxguitar-jsa"},{"binary_version":"1.5.6+dfsg1-8build3","binary_name":"tuxguitar-oss"},{"binary_name":"tuxguitar-synth-lv2","binary_version":"1.5.6+dfsg1-8build3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-14940.json"}},{"package":{"name":"tuxguitar","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/tuxguitar?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.6+dfsg1-2","1.6.6+dfsg1-3"],"ecosystem_specific":{"binaries":[{"binary_name":"tuxguitar","binary_version":"1.6.6+dfsg1-3"},{"binary_name":"tuxguitar-alsa","binary_version":"1.6.6+dfsg1-3"},{"binary_name":"tuxguitar-fluidsynth","binary_version":"1.6.6+dfsg1-3"},{"binary_version":"1.6.6+dfsg1-3","binary_name":"tuxguitar-jack"},{"binary_name":"tuxguitar-synth-lv2","binary_version":"1.6.6+dfsg1-3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-14940.json"}},{"package":{"name":"tuxguitar","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/tuxguitar?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.6+dfsg1-3","2.0.0+dfsg1-1","2.0.0+dfsg1-2","2.0.0+dfsg1-3"],"ecosystem_specific":{"binaries":[{"binary_name":"tuxguitar","binary_version":"2.0.0+dfsg1-3"},{"binary_version":"2.0.0+dfsg1-3","binary_name":"tuxguitar-alsa"},{"binary_version":"2.0.0+dfsg1-3","binary_name":"tuxguitar-fluidsynth"},{"binary_name":"tuxguitar-jack","binary_version":"2.0.0+dfsg1-3"},{"binary_name":"tuxguitar-synth-lv2","binary_version":"2.0.0+dfsg1-3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-14940.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"Ubuntu","score":"medium"}]}