Debian LTS: php-zip Important PHAR Deserialization 2025-4428-2

CVE-2021-3838

php-dompdf is vulnerable to PHAR deserialization due to a lack of
checking on the protocol before passing it into the
file_get_contents() function. An attacker who can upload files of
any type to the server can pass in the phar:// protocol to
unserialize the uploaded file and instantiate arbitrary PHP
objects. This can lead to remote code execution, especially when
DOMPdf is used with frameworks with documented POP chains like
Laravel or vulnerable developer code

CVE-2022-2400

php-dompdf was vulnerable to External Control of File Name bypassing
unallowed access verification.

For Debian 11 bullseye, these problems have been fixed in version
0.6.2+dfsg-3.1+deb11u1.

We recommend that you upgrade your php-dompdf packages.

For the detailed security status of php-dompdf please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/php-dompdf

Further information about Debian LTS security advisories, how to apply