Package · Maven

com.itextpdf:itextpdf

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

Critical 9.8

CVE-2021-43113

Command injection in itext7-core

iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.

com.itextpdf:itext7-core libitext5-java libitext5-java com.itextpdf:itextpdf Debian Ubuntu Maven

Dec 15, 2021
High 8.8

CVE-2017-9096 Public exploit

Improper Restriction of XML External Entity Reference in iText

The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.

com.itextpdf:itextpdf com.lowagie:itext Maven

Nov 8, 2017