Skip to content
OpenAdvisories
High DSA-5642-1 3 CVEs

php-dompdf-svg-lib - security update

Published Mar 20, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 12 php-dompdf-svg-lib 0.5.0-3+deb12u1

Vulnerabilities 3

  • High 8.3
    CVE-2023-50252 EPSS 24%

    php-svg-lib unsafe attributes merge when parsing `use` tag

    php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attributes from the `<use>` tag to the `<image>` tag. The problem pops up especially when the `href` attr…

    dompdf php-svg-lib php-dompdf-svg-lib Debian
  • Medium 6.8
    CVE-2024-25117

    php-svg-lib lacks path validation on font through SVG inline styles

    php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't contain a PHAR url, which might leads to RCE on PHP < 8.0, and doesn't validate if external referenc…

    dompdf php-svg-lib phenx/php-svg-lib php-dompdf-svg-lib Debian Packagist
  • Medium 5.3
    CVE-2023-50251

    php-svg-lib possible DoS caused by infinite recursion when parsing SVG document

    php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a `use` tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the system configuration an…

    dompdf php-svg-lib phenx/php-svg-lib php-dompdf-svg-lib Debian Packagist