Skip to content
OpenAdvisories

Package · Debian

php-dompdf

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2021-3902

    Improper Restriction of XML External Entity Reference in dompdf/dompdf

    An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even i…

    dompdf dompdf/dompdf dompdf/dompdf php-dompdf Debian Packagist
  • Critical 9.8
    CVE-2021-3838

    PHAR Deserialization in dompdf/dompdf

    DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to…

    dompdf dompdf/dompdf dompdf/dompdf php-dompdf Debian Ubuntu Packagist
  • Critical 10.0
    CVE-2023-24813

    URI validation failure on SVG parsing. Bypass of CVE-2023-23924

    Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrary URLs with arbitrary protocols. Dompdf parses the href attribute of `image` tags and respects `xlin…

    dompdf dompdf dompdf/dompdf php-dompdf Debian Packagist