GitHub Advisoryadvisory · Packagist

GHSA-5hw4-m7f3-hhx8 TCPDF vulnerable to attackers triggering deserialization of arbitrary data

CRITICAL Published 2022-10-06 Modified 2022-10-06 Official page ↗
Aliases
CVE-2018-17057
Ecosystem
Packagist
Packages
tecnickcom/tcpdf, fooman/tcpdf, la-haute-societe/tcpdf, spoonity/tcpdf
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2022-10-06

Affected packages

• Packagist tecnickcom/tcpdf: < 6.2.22 → fixed in 6.2.22 • Packagist fooman/tcpdf: < 6.2.22 → fixed in 6.2.22 • Packagist la-haute-societe/tcpdf: < 6.2.22 → fixed in 6.2.22 • Packagist spoonity/tcpdf: < 6.2.22 → fixed in 6.2.22

Description

An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the `phar://` wrapper.

Related

Alias · CVE (1)

  • CVE-2018-17057 An issue was discovered in TCPDF before 6.2.22. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References