Unscored CVE-2017-17523 EUVD-2017-8683GHSA-wwvq-3fw5-hw34

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment vari…

Published Dec 11, 2017 · Updated Aug 5, 2024 · Assigned by mitre

Package: lilypond Package: lilypond Ecosystem: Debian Ecosystem: Ubuntu

Description

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	lilypond	2.18.2-12	—
Debian 13	lilypond	2.18.2-12	—
Debian 12	lilypond	2.18.2-12	—

Ubuntu