{"id":"UBUNTU-CVE-2020-17353","details":"scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.","modified":"2025-10-24T04:48:38Z","published":"2020-08-05T14:15:00Z","upstream":["CVE-2020-17353"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2020-17353"},{"type":"REPORT","url":"http://git.savannah.gnu.org/gitweb/?p=lilypond.git;a=commit;h=b84ea4740f3279516905c5db05f4074e777c16ff"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2020-17353"}],"affected":[{"package":{"name":"lilypond","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/lilypond@2.18.2-4.1?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.18.2-4","2.18.2-4.1"],"ecosystem_specific":{"binaries":[{"binary_version":"2.18.2-4.1","binary_name":"lilypond"},{"binary_name":"lilypond-data","binary_version":"2.18.2-4.1"},{"binary_name":"lilypond-doc-html","binary_version":"2.18.2-4.1"},{"binary_name":"lilypond-doc-html-cs","binary_version":"2.18.2-4.1"},{"binary_name":"lilypond-doc-html-de","binary_version":"2.18.2-4.1"},{"binary_name":"lilypond-doc-html-es","binary_version":"2.18.2-4.1"},{"binary_name":"lilypond-doc-html-fr","binary_version":"2.18.2-4.1"},{"binary_name":"lilypond-doc-html-hu","binary_version":"2.18.2-4.1"},{"binary_name":"lilypond-doc-html-it","binary_version":"2.18.2-4.1"},{"binary_name":"lilypond-doc-html-ja","binary_version":"2.18.2-4.1"},{"binary_name":"lilypond-doc-html-nl","binary_version":"2.18.2-4.1"},{"binary_name":"lilypond-doc-html-zh","binary_version":"2.18.2-4.1"},{"binary_version":"2.18.2-4.1","binary_name":"lilypond-doc-pdf"},{"binary_name":"lilypond-doc-pdf-de","binary_version":"2.18.2-4.1"},{"binary_name":"lilypond-doc-pdf-es","binary_version":"2.18.2-4.1"},{"binary_name":"lilypond-doc-pdf-fr","binary_version":"2.18.2-4.1"},{"binary_name":"lilypond-doc-pdf-hu","binary_version":"2.18.2-4.1"},{"binary_name":"lilypond-doc-pdf-it","binary_version":"2.18.2-4.1"},{"binary_name":"lilypond-doc-pdf-nl","binary_version":"2.18.2-4.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-17353.json"}},{"package":{"name":"lilypond","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/lilypond@2.18.2-12build1?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.18.2-9","2.18.2-11","2.18.2-12","2.18.2-12build1"],"ecosystem_specific":{"binaries":[{"binary_name":"lilypond","binary_version":"2.18.2-12build1"},{"binary_name":"lilypond-data","binary_version":"2.18.2-12build1"},{"binary_name":"lilypond-doc-html","binary_version":"2.18.2-12build1"},{"binary_name":"lilypond-doc-html-cs","binary_version":"2.18.2-12build1"},{"binary_name":"lilypond-doc-html-de","binary_version":"2.18.2-12build1"},{"binary_version":"2.18.2-12build1","binary_name":"lilypond-doc-html-es"},{"binary_name":"lilypond-doc-html-fr","binary_version":"2.18.2-12build1"},{"binary_name":"lilypond-doc-html-hu","binary_version":"2.18.2-12build1"},{"binary_name":"lilypond-doc-html-it","binary_version":"2.18.2-12build1"},{"binary_name":"lilypond-doc-html-ja","binary_version":"2.18.2-12build1"},{"binary_name":"lilypond-doc-html-nl","binary_version":"2.18.2-12build1"},{"binary_name":"lilypond-doc-html-zh","binary_version":"2.18.2-12build1"},{"binary_name":"lilypond-doc-pdf","binary_version":"2.18.2-12build1"},{"binary_name":"lilypond-doc-pdf-de","binary_version":"2.18.2-12build1"},{"binary_name":"lilypond-doc-pdf-es","binary_version":"2.18.2-12build1"},{"binary_name":"lilypond-doc-pdf-fr","binary_version":"2.18.2-12build1"},{"binary_name":"lilypond-doc-pdf-hu","binary_version":"2.18.2-12build1"},{"binary_version":"2.18.2-12build1","binary_name":"lilypond-doc-pdf-it"},{"binary_version":"2.18.2-12build1","binary_name":"lilypond-doc-pdf-nl"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-17353.json"}},{"package":{"name":"lilypond","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/lilypond@2.20.0-1?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.81+really-2.18.2-13ubuntu1","2.19.81+really-2.18.2-13ubuntu2","2.19.81+really-2.18.2-14","2.20.0-1"],"ecosystem_specific":{"binaries":[{"binary_name":"lilypond","binary_version":"2.20.0-1"},{"binary_name":"lilypond-data","binary_version":"2.20.0-1"},{"binary_name":"lilypond-doc-html","binary_version":"2.20.0-1"},{"binary_name":"lilypond-doc-html-ca","binary_version":"2.20.0-1"},{"binary_name":"lilypond-doc-html-cs","binary_version":"2.20.0-1"},{"binary_name":"lilypond-doc-html-de","binary_version":"2.20.0-1"},{"binary_name":"lilypond-doc-html-es","binary_version":"2.20.0-1"},{"binary_name":"lilypond-doc-html-fr","binary_version":"2.20.0-1"},{"binary_name":"lilypond-doc-html-hu","binary_version":"2.20.0-1"},{"binary_version":"2.20.0-1","binary_name":"lilypond-doc-html-it"},{"binary_name":"lilypond-doc-html-ja","binary_version":"2.20.0-1"},{"binary_version":"2.20.0-1","binary_name":"lilypond-doc-html-nl"},{"binary_name":"lilypond-doc-html-zh","binary_version":"2.20.0-1"},{"binary_name":"lilypond-doc-pdf","binary_version":"2.20.0-1"},{"binary_name":"lilypond-doc-pdf-ca","binary_version":"2.20.0-1"},{"binary_version":"2.20.0-1","binary_name":"lilypond-doc-pdf-de"},{"binary_name":"lilypond-doc-pdf-es","binary_version":"2.20.0-1"},{"binary_version":"2.20.0-1","binary_name":"lilypond-doc-pdf-fr"},{"binary_name":"lilypond-doc-pdf-hu","binary_version":"2.20.0-1"},{"binary_name":"lilypond-doc-pdf-it","binary_version":"2.20.0-1"},{"binary_name":"lilypond-doc-pdf-nl","binary_version":"2.20.0-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-17353.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}