—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2023.3978
php-dompdf security update
14 July 2023
===========================================================================
AusCERT Security Bulletin Summary
———————————
Product: php-dompdf
Publisher: Debian
Operating System: Debian GNU/Linux
Resolution: Patch/Upgrade
CVE Names: CVE-2022-2400 CVE-2021-3838
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2023/07/msg00017.html
Comment: CVSS (Max): 5.3* CVE-2022-2400 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVSS Source: NVD
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
* Not all CVSS available when published
– ————————–BEGIN INCLUDED TEXT——————–
– —–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA512
– – ————————————————————————-
Debian LTS Advisory DLA-3495-1 [email protected]
https://www.debian.org/lts/security/ Bastien Roucariès
July 13, 2023 https://wiki.debian.org/LTS
– – ————————————————————————-
Package : php-dompdf
Version : 0.6.2+dfsg-3+deb10u1
CVE ID : CVE-2021-3838 CVE-2022-2400
Debian Bug : #1015874
Multiple vulnerabilies were fixed in php-dompdf a CSS 2.1 compliant HTML
to PDF converter, written in PHP.
CVE-2021-3838
php-dompdf was vulnerable to deserialization of Untrusted Data using
PHAR deserialization (phar://) as url for image.
CVE-2022-2400
php-dompdf was vulnerable to External Control of File Name bypassing
unallowed access verification.
For Debian 10 buster, these problems have been fixed in version
0.6.2+dfsg-3+deb10u1.
We recommend that you upgrade your php-dompdf packages.
For the detailed security status of php-dompdf please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/php-dompdf
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
– —–BEGIN PGP SIGNATURE—–
iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmSwabkACgkQADoaLapB
CF8nsRAAsmeQ4TBOyOXOcCYD4juWGEb2PEqzoBtGUKnS6N8lWfWuFF9fUKjRSvVq
UQ2kWHSDbT40qTd8eVNm0a1lRaHuubYhHKVtemiMJ71cJkInWQm9JDCCHdYPlN/t
tj1ihB5IWi+yrpOuMzP4QN57kNo27U8tRWNb7eRBP3bECtt/CZtHzaq2zwk7tX6P
SJWkVcTlIg9AHa33vq5/7FJ5o2pF4SUOL2zPs4Z0zqBKUhmXeg3ByYDvkgZMbgTL
zE8RnGIc4pcBuwrhVhBpOv3mvUSfSbko0AqiUS45mgxMUuuSw+cUJwFtRAsH7Bh6
ElZwfkjiWIyrW5w8M1V8vi5ghwUl1AKd5stHjZXEcAYR0HZh1VcXgBB35LPYWzGR
oL8FsD8ngQlCuaNPX3EgdbiluwiewLk9buYZYUb9BbnmCn/LxR7W5TkdnM4pUGU9
nuAEtPneim9qakqyeXLH2vOSlivCAj66iWLiDGbQTPwTjmmYgHlj3FNBuGUDQicL
vdYJIRCVywAt2V2ebFWmxYUDsdFzuVXKfGYi+HOWUM8s9q5A1tGrQ+mGydWc+ses
+u+2c7sNr5iuxF4NE/VdOBxfMy5zLSCRf+9Jccbkq29Y6UuvSCTMUo2L2ZwJIGxG
MVmeBZZ1Ihm633lov0PsILBFfSmueXco0rMMW2/HFGoV2s4feuA=
=ueR0
– —–END PGP SIGNATURE—–
– ————————–END INCLUDED TEXT——————–
You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to [email protected]
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: [email protected]
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBZLDC78kNZI30y1K9AQjfLxAAlgP59i0lzgmS1hZUlSM1JUNACXGOWaKW
B3JhCyH/MSn3/2iWtEGBJIMXjwFyJE7PZQ0ez7cNiHvn5nSThVM8r0gXZMhjo1Uw
uzkzx8ogTaALxuCtrZM16BR+qrTi/C7blfGdCHumgEf3x4NNUwKcj39cMIIswUVP
tJHjsyCvCGRSY2aXHhhEUN4I9/bixtoq2mX3212uXZ3jQ1JXZH85+PdDYd/rFy3o
FBLIBHGug8XaSqNkYcdIol6NLJQf4D6wFDl4fO7Cd9aMMQfbrJaPDqE2gnxzzbN3
WTRwFPDXGwj1/UwkX2Tfe0XbCvR868nNo9dC+NWLsz9McjgxCqH6ykkIJ0BoQv1w
nd7A3G/74hE4egCxEq8FV84eKbP7pSHcLTv9wSh7OBXG3r82YRps3ZCjhnvkwQxL
wPnnZAmpxrN0a/eMgfLDxlFDwtAVV/Rlqe8bHQIUHVGoL6fRNd9FKJa0GNtXu2Yr
yWAPOAXq9PZhjtE/fGfFiDMjgUqUzTm0OV0asWKuAX78eH40qJXlK0kP4/qrHNSO
kGYoxuOGHv4Vll7MM0Tno5PAcWZAILg6p79DLtn6P38X8YlS8vl/hBWtpXPaf2Pk
b31JrQtg/xDdqjNe+sNLBq1Co7jH4RdXBH0G5gR2uLPDFDkFw5BAC6NvMw4G1IRI
kYyJUMuiUzU=
=bISl
—–END PGP SIGNATURE—–
Source: Read More
Security Bulletins