Fedora 40: php-tcpdf 6.7.7 ReDoS Fix Advisory - Critical Threat

PHP class for generating PDF documents.

* no external libraries are required for the basic functions;

* all standard page formats, custom page formats, custom margins and units

of measure;

* UTF-8 Unicode and Right-To-Left languages;

* TrueTypeUnicode, OpenTypeUnicode, TrueType, OpenType, Type1 and CID-0 fonts;

* font subsetting;

* methods to publish some XHTML + CSS code, Javascript and Forms;

* images, graphic (geometric figures) and transformation methods;

* supports JPEG, PNG and SVG images natively, all images supported by GD

(GD, GD2, GD2PART, GIF, JPEG, PNG, BMP, XBM, XPM) and all images supported

via ImagMagick (http: )

* 1D and 2D barcodes: CODE 39, ANSI MH10.8M-1983, USD-3, 3 of 9, CODE 93,

USS-93, Standard 2 of 5, Interleaved 2 of 5, CODE 128 A/B/C, 2 and 5 Digits

UPC-Based Extention, EAN 8, EAN 13, UPC-A, UPC-E, MSI, POSTNET, PLANET,

RMS4CC (Royal Mail 4-state Customer Code), CBC (Customer Bar Code),

KIX (Klant index - Customer index), Intelligent Mail Barcode, Onecode,

USPS-B-3200, CODABAR, CODE 11, PHARMACODE, PHARMACODE TWO-TRACKS,

Datamatrix ECC200, QR-Code, PDF417;

* ICC Color Profiles, Grayscale, RGB, CMYK, Spot Colors and Transparencies;

* automatic page header and footer management;

* document encryption up to 256 bit and digital signature certifications;

* transactions to UNDO commands;

* PDF annotations, including links, text and file attachments;

* text rendering modes (fill, stroke and clipping);

* multiple columns mode;

* no-write page regions;

* bookmarks and table of content;

* text hyphenation;

* text stretching and spacing (tracking/kerning);

* automatic page break, line break and text alignments including justification;

* automatic page numbering and page groups;

* move and delete pages;

* page compression (requires php-zlib extension);

* XOBject templates;

* PDF/A-1b (ISO 19005-1:2005) support.

By default, TCPDF uses the GD library which is know as slower than ImageMagick

solution. You can optionally install php-pecl-imagick; TCPDF will use it.

Version 6.7.7 (2024-10-26) Update regular expression to avoid ReDoS (CVE-2024-22641) [PHP 8.4] Fix: Curl CURLOPT_BINARYTRANSFER deprecated #675 SVG detection fix for inline data images #646 Fix count svg #647 Since the version 6.7.4, the "0" is considered like empty string and not displayed Fixed handling of transparency in PDF/A mode in addExtGState method Encrypt /DA string when document is encrypted Improve quality of generated seed, avoid potential security pitfall Try to use random_bytes() first if it's available Do not include the server parameters in the generated seed, as they might contain sensitive data Fix bug on _getannotsrefs when there are empty signature appearances but not other annot on a page Fix SVG coordinate parser that caused drawing artifacts Remove usage of xml_set_object() function