Fedora 41 : php-tcpdf (2025-85549e07c8)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-85549e07c8 advisory. Version 6.9.1 2025-04-03 - Fixed Path Traversal security vulnerability reported by Positive Technologies. ---- Version 6.9.0 2025-03-30 - Added PHP 8.4...

PT-2025-07: Path Traversal in TCPDF

The vulnerability was identified in TCPDF, version 6.8.2. The application performs insufficient validation of user input data. Decoding user input allows an attacker to form a path to an arbitrary image on the server, access to which is not provided by the logic of the application, with subsequen...

PT-2025-09: Path Traversal in TCPDF

The application performs insufficient validation of relative paths when processing SVG image. Bypassing validation using the payload allows an attacker to form a path to an arbitrary image on the server, access to which is not provided by the logic of the application, with subsequent inclusion of...

PT-2025-52460

Уязвимость PHP-библиотеки TCPDF с неверным ограничением имени пути к каталогу с ограниченным доступом. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, получить несанкционированный доступ к защищаемой информации...

PT-2025-37714

Уязвимость PHP-библиотеки TCPDF с неверным ограничением имени пути к каталогу с ограниченным доступом. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, получить несанкционированный доступ к защищаемой информации...

Linux Distros Unpatched Vulnerability : CVE-2024-56519

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute. CVE-2024-56519 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2024-56521

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPTSSLVERIFYHOST and CURLOPTSSLVERIFYPEER are set unsafely. CVE-2024-56521 Note that Ness...

Linux Distros Unpatched Vulnerability : CVE-2024-56520

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in tc-lib-pdf-font before 2.6.4, as used in TCPDF before 6.8.0 and other products. Fonts are mishandled, e.g., FontBBox for Type 1 and...

Linux Distros Unpatched Vulnerability : CVE-2024-56527

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message. CVE-2024-56527 Note that Nessus relies o...

Linux Distros Unpatched Vulnerability : CVE-2024-51058

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Local File Inclusion LFI vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user to read arbitrary files from the server's file syst...

Linux Distros Unpatched Vulnerability : CVE-2024-56522

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != aka loose comparison and does not use a constant-time function to compare TCPDF tag...

Linux Distros Unpatched Vulnerability : CVE-2024-22641

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - TCPDF version 6.6.5 and before is vulnerable to ReDoS Regular Expression Denial of Service if parsing an untrusted SVG file. CVE-2024-22641 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2024-22640

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - TCPDF version =6.6.5 is vulnerable to ReDoS Regular Expression Denial of Service if parsing an untrusted HTML page with a crafted color. CVE-2024-22640 Note tha...

Linux Distros Unpatched Vulnerability : CVE-2024-32489

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - TCPDF before 6.7.4 mishandles calls that use HTML syntax. CVE-2024-32489 Note that Nessus relies on the presence of the package as reported by the vendor...

CVE-2024-22641

TCPDF version 6.6.5 and before is vulnerable to ReDoS Regular Expression Denial of Service if parsing an untrusted SVG file...

Mageia: Security Advisory (MGASA-2025-0059)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2025-0059 Updated php-tcpdf packages fix security vulnerabilities

An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute. CVE-2024-56519 An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPTSSLVERIFYHOST and CURLOPTSSLVERIFYPEER are set unsafely. CVE-2024-56521 An issue was discovered in...

Updated php-tcpdf packages fix security vulnerabilities

An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute. CVE-2024-56519 An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPTSSLVERIFYHOST and CURLOPTSSLVERIFYPEER are set unsafely. CVE-2024-56521 An issue was discovered in...

PT-2025-02: Access to files or directories to external paties in TCPDF

The vulnerability was identified in TCPDF, version 6.8.0. The discovered vulnerability allows an attacker to transmit a specially created HTML file containing an image in Base64 format. Using the specified payload, the attacker can access an arbitrary image outside of the directory. Vulnerability...

PT-2025-37711

Уязвимость PHP-библиотеки TCPDF связана с использованием файлов и каталогов, доступных внешним сторонам. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...