CVE-2018-10992 lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injec...
CriticalCVSS 9.8
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument, because the GNU Guile code uses the system Scheme procedure instead of the system* Scheme procedure. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-17523.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/lilypond(Debian:12) | < 2.18.2-13 | 2.18.2-13 |
| debian/lilypond(Debian:13) | < 2.18.2-13 | 2.18.2-13 |
| debian/lilypond(Debian:14) | < 2.18.2-13 | 2.18.2-13 |
| lilypond | = 2.19.80 | No fix listed |
References
- Debian Security Tracker CVE-2018-10992 vendor-advisory
- bugs.debian.org issue-tracking third-party-advisory