Source: tuxguitar Version: 2.0.0+dfsg1-3 X-Debbugs-CC: [email protected] Severity: grave Tags: security upstream
Hi, The following vulnerability was published for tuxguitar. CVE-2026-55543[0]: | TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, | an untrusted .tg file can set gervil.soundbank.path to reference an | on-disk archive, including the .tg file itself, whose META- | INF/services/javax.sound.midi.Soundbank entry names an attacker- | supplied class stored in that archive. When a user opens the file, | JARSoundbankReader uses an unverified class loader to load and | instantiate that class, executing its constructor with the | privileges of the TuxGuitar process. This issue is fixed in version | 2.1.0. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-55543 https://www.cve.org/CVERecord?id=CVE-2026-55543 [1] https://github.com/helge17/tuxguitar/security/advisories/GHSA-v66p-c82h-w3cq [2] https://github.com/helge17/tuxguitar/commit/a7eef20e2e02ee454597d42c295327d9f098c636 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
