CVE-2024-22641

2024-05-2821:16:29

Debian Security Bug Tracker

security-tracker.debian.org

tcpdf

6.6.5

redos

svg

parsing

vulnerability

unix

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.1

Confidence

Low

JSON

TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.

OSVersionArchitecturePackageVersionFilename
Debian12alltcpdf<= 6.6.2+dfsg1-1tcpdf_6.6.2+dfsg1-1_all.deb
Debian11alltcpdf<= 6.3.5+dfsg1-1tcpdf_6.3.5+dfsg1-1_all.deb
Debian999alltcpdf<= 6.7.5+dfsg-1tcpdf_6.7.5+dfsg-1_all.deb
Debian13alltcpdf<= 6.7.5+dfsg-1tcpdf_6.7.5+dfsg-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	tcpdf	<= 6.6.2+dfsg1-1	tcpdf_6.6.2+dfsg1-1_all.deb
Debian	11	all	tcpdf	<= 6.3.5+dfsg1-1	tcpdf_6.3.5+dfsg1-1_all.deb
Debian	999	all	tcpdf	<= 6.7.5+dfsg-1	tcpdf_6.7.5+dfsg-1_all.deb
Debian	13	all	tcpdf	<= 6.7.5+dfsg-1	tcpdf_6.7.5+dfsg-1_all.deb