Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Mageia 9: Critical Security Fixes for php-tcpdf in Update 2025-0059

mageia
Calendar Grey February 12, 2025
Scroller Mageia
MGASA-2025-0060 revised php-mpdf components resolve security flaws for Mageia users concerning identified vulnerabilities.
An issue was discovered in TCPDF before 6.8.0

Summary

An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute. (CVE-2024-56519) An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely. (CVE-2024-56521) An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes. (CVE-2024-56522) An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message. (CVE-2024-56527)

References

- https://bugs.mageia.org/show_bug.cgi?id=33898

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZX3ABLKKEVGN4M4BBUJFPBNWW5SHP7J3/

- https://www.cve.org/CVERecord?id=CVE-2024-56519

- https://www.cve.org/CVERecord?id=CVE-2024-56521

- https://www.cve.org/CVERecord?id=CVE-2024-56522

- https://www.cve.org/CVERecord?id=CVE-2024-56527

Topics%20covered

Topics Covered

security advisory sanitization issue Mageia php-tcpdf libcurl threat

Resolution

SRPMS

- 9/core/php-tcpdf-6.5.0-1.3.mga9

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 12 Feb 2025
URL: https://advisories.mageia.org/MGASA-2025-0059.html
Type: security
CVE: CVE-2024-56519, CVE-2024-56521, CVE-2024-56522, CVE-2024-56527

Topics%20covered

Topics Covered

security advisory sanitization issue Mageia php-tcpdf libcurl threat

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.