{"id":"CVE-2020-17353","aliases":["DEBIAN-CVE-2020-17353","DSA-4756-1","EUVD-2020-9307","GHSA-wg4f-3xq5-x79h","MGASA-2020-0414","UBUNTU-CVE-2020-17353","openSUSE-SU-2020:1453-1","openSUSE-SU-2020:1506-1","openSUSE-SU-2024:11021-1"],"status":"published","title":"scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when ...","description":"scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02306,"percentile":0.83494,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2020-08-05T12:55:02Z","modified":"2026-10-26T12:02:28Z","fixes":[{"ecosystem":"Debian:12","package":"lilypond","fixed_in":["2.20.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lilypond","fixed_in":["2.20.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lilypond","fixed_in":["2.20.0-2"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"lilypond","fixed_in":["2.19.81+really-2.18.2-13+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"lilypond","fixed_in":["2.19.83-1.1.mga7"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP2","package":"lilypond","fixed_in":["2.20.0-bp152.2.5.6","2.20.0-bp152.2.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP2","package":"lilypond-doc","fixed_in":["2.20.0-lp152.2.5.10"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"lilypond","fixed_in":["2.20.0-bp152.2.5.6"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"lilypond-doc","fixed_in":["2.20.0-lp152.2.5.10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"lilypond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lilypond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lilypond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-2"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"lilypond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.81+really-2.18.2-13+deb10u1"}]}],"versions":["2.19.81+really-2.18.2-13"]},{"source":"osv","ecosystem":"Mageia:7","package":"lilypond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.83-1.1.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"lilypond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.18.2-4","2.18.2-4.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"lilypond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.18.2-9","2.18.2-11","2.18.2-12","2.18.2-12build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lilypond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.81+really-2.18.2-13ubuntu1","2.19.81+really-2.18.2-13ubuntu2","2.19.81+really-2.18.2-14","2.20.0-1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"lilypond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-bp152.2.5.6"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"lilypond-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-lp152.2.5.10"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"lilypond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-bp152.2.5.6"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"lilypond-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-lp152.2.5.10"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"lilypond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-bp152.2.8.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"lilypond","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23.3-1.3"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"lilypond","product":"lilypond"},{"vendor":"opensuse","product":"backports_sle"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"http://git.savannah.gnu.org/gitweb/?p=lilypond.git%3Ba=commit%3Bh=b84ea4740f3279516905c5db05f4074e777c16ff","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QG2JUV4UTIA27JUE6IZLCEFP5PYSFPF4/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2JYMVLTPSNYS5F7TBHKIXUZZJIJAMRX/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.debian.org/security/2020/dsa-4756","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00064.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00076.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-17353"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QG2JUV4UTIA27JUE6IZLCEFP5PYSFPF4/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2JYMVLTPSNYS5F7TBHKIXUZZJIJAMRX/"},{"url":"http://git.savannah.gnu.org/gitweb/?p=lilypond.git;a=commit;h=b84ea4740f3279516905c5db05f4074e777c16ff","tags":["report"]},{"url":"https://github.com/advisories/GHSA-wg4f-3xq5-x79h"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-17353","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0414.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27174","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/QG2JUV4UTIA27JUE6IZLCEFP5PYSFPF4/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-17353","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-17353","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LZLU3RBT6EACHJVY3TSE3V25RFIN7ZMM/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1174949","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17353","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MJP3VB3XJ47C64LSD4XRTENGM2FHG2VC/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10992","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-17353","description":"scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.","status":"published","published":"2020-08-05T12:55:02Z","modified":"2024-08-04T13:53:17.011Z","updated_at":"2026-11-02T14:35:54.80237Z"}],"euvd":[{"id":"EUVD-2020-9307","description":"scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.","status":"published","published":"2020-08-05T12:55:02Z","modified":"2024-08-04T13:53:17Z","updated_at":"2026-11-03T03:07:27.538796Z"}],"ghsa":[{"id":"GHSA-wg4f-3xq5-x79h","title":"scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when ...","description":"scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.","status":"published","published":"2022-05-24T17:24:59Z","modified":"2023-01-31T05:06:03Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:48:58.134588Z"}],"nvd":[{"id":"CVE-2020-17353","description":"scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.","status":"published","published":"2020-08-05T14:15:12.81Z","modified":"2026-06-17T02:58:47.433Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:06:10.994748Z"}],"osv":[{"id":"CVE-2020-17353","description":"scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.","status":"published","published":"2020-08-05T14:15:12.81Z","modified":"2026-10-24T10:30:32.813950515Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"DEBIAN-CVE-2020-17353","description":"scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.","status":"published","published":"2020-08-05T14:15:12.81Z","modified":"2026-10-26T12:02:28.110412444Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"UBUNTU-CVE-2020-17353","description":"scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.","status":"published","published":"2020-08-05T14:15:00Z","modified":"2025-10-24T04:48:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"DSA-4756-1","title":"lilypond - security update","status":"published","published":"2020-08-29T00:00:00Z","modified":"2026-03-09T02:11:30.308434Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0414","title":"Updated lilypond package fixes a security vulnerability","description":"It was discovered that Lilypond, a program for typesetting sheet music, did\nnot restrict the inclusion of Postscript and SVG commands when operating in\nsafe mode, which could result in the execution of arbitrary code when rendering\na typesheet file with embedded Postscript code.\n(CVE-2020-17353)\n","status":"published","published":"2020-11-13T21:20:36Z","modified":"2026-04-16T04:44:14.321648296Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2020:1453-1","title":"Security update for lilypond","description":"This update for lilypond fixes the following issues:\n\n- CVE-2020-17353: When -dsafe is used, LilyPond lacks restrictions on embedded-ps and embedded-svg (boo#1174949).\n","status":"published","published":"2020-09-19T12:20:36Z","modified":"2026-02-04T02:51:25.325139Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1506-1","title":"Security update for lilypond","description":"This update for lilypond fixes the following issues:\n\n- CVE-2020-17353: When -dsafe is used, LilyPond lacks restrictions on embedded-ps and embedded-svg (boo#1174949).\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2020-09-22T16:22:41Z","modified":"2026-02-04T02:56:42.517315Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:11021-1","title":"lilypond-2.23.3-1.3 on GA media","description":"These are all security issues fixed in the lilypond-2.23.3-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:46:49.818444Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}