CVE-2017-17523
N/A
N/A
Summary
lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a –proxy-pac-file argument.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| n/a | n/a | n/a | affected |
Weaknesses
- n/a
ADP Enrichment
CVE Program Container
Additional References
- https://bugs.debian.org/884136
- https://sourceforge.net/p/testlilyissues/issues/5243/
- https://bugs.debian.org/881767
References
- https://bugs.debian.org/884136
- https://sourceforge.net/p/testlilyissues/issues/5243/
- https://bugs.debian.org/881767
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.