Debian dla-3273 : libitext5-java - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3273 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3273-1 [email protected] https://www.debian.org/lts/security/...

[SECURITY] [DSA 5323-1] libitext5-java security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5323-1 [email protected] https://www.debian.org/security/ Markus Koschany January 19, 2023 https://www.debian.org/security/faq -...

club.javafamily:javafamily-utils-all (>=2.3.2-beta.3 <=2.3.2-beta.4), club.javafamily:javafamily-utils-pdf-itext (>=2.3.2-beta.3 <=2.3.2-beta.4) +214 more potentially affected by CVE-2021-43113 via com.itextpdf:itext7-core (>=7.0.4 <=7.1.16)

com.itextpdf:itext7-core MAVEN version =7.0.4, =2.3.2-beta.3, =2.3.2-beta.3, =1.6.0, =0.0.30, =0.1, =1.0, =1.0, =1.0, =1.1 - com.houkunlin.easypoi:easypoi-base =5.0.2 - com.houkunlin.easypoi:easypoi-spring-boot-starter =5.0.2 - com.houkunlin.easypoi:easypoi-web =5.0.2 -...

aero.m-click:mcpdf (>=0.2.0 <=0.2.6), at.iem:sysson_2.11 (>=1.13.0 <=1.17.0) +712 more potentially affected by CVE-2021-43113 via com.itextpdf:itextpdf (>=5.0.6 <=5.5.13.2)

com.itextpdf:itextpdf MAVEN version =5.0.6, =0.2.0, =1.13.0, =1.13.0, =2.0.0, =1.2.1, =3.0.0, =2.0.0, =0.7, =0.7, =1.1.5, =1.5.1.beta and more Source cves: CVE-2021-43113 Source advisory: SNYK:JAVA-COMITEXTPDF-15674470...

CVE-2021-43113

The CVE-2021-43113 case concerns iTextPDF (iText 7 era) where the CompareTool filename handling interacts with Ghostscript, enabling a command injection via GhostscriptHelper.java. Affected products/versions: iTextPDF before 7.1.17 (up to but not including 4.4.13.3); the Debian/libitext5-java adv...