lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument. Upstream issue: https://sourceforge.net/p/testlilyissues/issues/5243/ Debian bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=884136
Created lilypond tracking bugs for this issue: Affects: fedora-all [bug 1524940]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.