Stay Secure with the Latest Linux Advisories

security advisorysanitization issueMageia

Mageia 9: Critical Security Fixes for php-tcpdf in Update 2025-0059

An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute. (CVE-2024-56519) An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely. (CVE-2024-56521) . MGASA-2025-0059 - Updated php-tcpdf packages fix security vulnerabilities Publication date: 12 Feb 2025 URL: https://advisories.mageia.org/MGASA-2025-0059.html Type: security Affected Mageia releases: 9 CVE: CVE-2024-56519, CVE-2024-56521, CVE-2024-56522, CVE-2024-56527 An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute. (CVE-2024-56519) An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely. (CVE-2024-56521) An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes. (CVE-2024-56522) An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message. (CVE-2024-56527) References: - https://bugs.mageia.org/show_bug.cgi?id=33898 - https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./message/ZX3ABLKKEVGN4M4BBUJFPBNWW5SHP7J3/ - https://www.cve.org/CVERecord?id=CVE-2024-56519 - https://www.cve.org/CVERecord?id=CVE-2024-56521 - https://www.cve.org/CVERecord?id=CVE-2024-56522 - https://www.cve.org/CVERecord?id=CVE-2024-56527 SRPMS: - 9/core/php-tcpdf-6.5.0-1.3.mga9 . MGASA-2025-0060 revised php-mpdf components resolve security flaws for Mageia users concerning identified vulnerabilities.. php-tcpdf, Mageia security, vulnerability fixes. . Severity: Critical. LinuxSecurity.com Team

Feb 12, 2025 •Critical Mageia