CVE-2021-43113

iTextPDF in iText 7 and up to excluding 4.4.13.3 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs aka Ghostscript command line in GhostscriptHelper.java...

CVE-2021-43113

iTextPDF in iText 7 and up to excluding 4.4.13.3 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs aka Ghostscript command line in GhostscriptHelper.java...

CVE-2021-43113

The CVE-2021-43113 case concerns iTextPDF (iText 7 era) where the CompareTool filename handling interacts with Ghostscript, enabling a command injection via GhostscriptHelper.java. Affected products/versions: iTextPDF before 7.1.17 (up to but not including 4.4.13.3); the Debian/libitext5-java adv...

XML External Entity (XXE) Injection

itextpdf is vulnerable to XML external entity XXE injection attacks. These attacks are possible because the library does not disable external entities when parsing pdf files...

aero.m-click:mcpdf (>=0.2.0, <=0.2.4), at.iem:sysson_2.10 (1.12.0) +506 more potentially affected by CVE-2017-9096 via com.itextpdf:itextpdf (>=5.0.6, <=5.5.11)

com.itextpdf:itextpdf MAVEN version =5.0.6, =0.2.0, =1.10.2, =1.13.0, =1.1.8, =20.3.0, =24.2.0, =20.3.0, =2.23.5, =2.23.5, =23.1.0, =2.23.0, =2.23.5, =20.2.0 and more Source cves: CVE-2017-9096 Source advisory: MEND:CVE-2017-9096...