| Package | Affected versions | Patched versions |
|---|---|---|
| lilypond | ≥ 2.21.0, ≤ 2.21.4≤ 2.20.0 | |
| backports sle | = 15.0 |
scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, as demonstrated by including dangerous PostScript code.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free