Lucene search
Veracode Vulnerability DatabaseVERACODE:37290HistorySep 27, 2022 - 5:16 a.m.
Remote Code Execution (RCE)
2022-09-2705:16:03
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
12
dompdf
vulnerability
registerfont
remote code execution
0.003 Low
EPSS
Percentile
65.9%
dompdf/dompdf is vulnerable to remote code execution. The vulnerability exists because the registerFont function of FontMetrics.php does not properly halt the font registration when URI validation fails, such as through the @font-face rule, allowing an attacker to inject and execute maliciously crafted files.
| CPE | Name | Operator | Version |
|---|---|---|---|
| dompdf/dompdf | le | v2.0.0 | |
| dompdf/dompdf | le | v2.0.0 |
Related
cve
cve
CVE-2022-41343
2022-09-25 19:15:09
osv
osv
Dompdf allows remote file inclusion because URI validation failure does not halt font registration
2022-09-26 00:00:23
CVE-2022-41343
2022-09-25 19:15:09
githubexploit
githubexploit
nvd
nvd
CVE-2022-41343
2022-09-25 19:15:09
prion
prion
Remote file inclusion
2022-09-25 19:15:00
ubuntucve
ubuntucve
CVE-2022-41343
2022-09-25 00:00:00
github
github
debiancve
debiancve
CVE-2022-41343
2022-09-25 19:15:09
friendsofphp
friendsofphp
Remote file inclusion
2022-09-22 13:54:00
cvelist
cvelist
CVE-2022-41343
2022-09-25 00:00:00