CVE-2017-17523 Information

Description

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable which allows remote attackers to conduct argument-injection attacks via a crafted URL as demonstrated by a –proxy-pac-file argument.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Reference

https://bugs.debian.org/881767 https://bugs.debian.org/884136 https://sourceforge.net/p/testlilyissues/issues/5243/

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

8.8