Lucene search

Veracode Vulnerability DatabaseVERACODE:45600

HistoryFeb 22, 2024 - 9:20 a.m.

Arbitrary Code Execution

2024-02-2209:20:32

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

arbitrary code execution

vulnerability

validation

scalable vector graphics

phar url

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.1%

JSON

phenx/php-svg-lib is vulnerable to Arbitrary Code Execution. The vulnerability due to lack of validation of the font-family attribute. An attacker can parse a Scalable Vector Graphics (SVG) containing a PHAR url within the the font family attribute, potentially leading to arbitrary code execution.

CPENameOperatorVersion
phenx/php-svg-lible0.5.1
phenx/php-svg-lible0.5.1

CPE	Name	Operator	Version
	phenx/php-svg-lib	le	0.5.1
	phenx/php-svg-lib	le	0.5.1

References

github.com/dompdf/php-svg-lib/commit/732faa9fb4309221e2bd9b2fda5de44f947133aa

github.com/dompdf/php-svg-lib/commit/8ffcc41bbde39f09f94b9760768086f12bbdce42

github.com/dompdf/php-svg-lib/security/advisories/GHSA-f3qr-qr4x-j273