Packagist/spoonity/tcpdf CVE-2018-17057: critical 9.8, EPSS 26.17%

TCPDF vulnerable to attackers triggering deserialization of arbitrary data

Action: Upgrade spoonity/tcpdf to 6.2.22 or later.

composer require spoonity/tcpdf:6.2.22

Affected

Fixed versions

Sources

• osv: GHSA-5hw4-m7f3-hhx8#Packagist/spoonity/tcpdf
• https://nvd.nist.gov/vuln/detail/CVE-2018-17057
• https://github.com/LimeSurvey/LimeSurvey/commit/1cdd78d27697b3150bb44aaa7af1a81062a591a5
• https://github.com/tecnickcom/TCPDF/commit/1861e33fe05f653b67d070f7c106463e7a5c26ed
• https://contao.org/en/news/security-vulnerability-cve-2018-17057.html
• https://github.com/FriendsOfPHP/security-advisories/blob/master/fooman/tcpdf/CVE-2018-17057.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/la-haute-societe/tcpdf/CVE-2018-17057.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/spoonity/tcpdf/CVE-2018-17057.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/tecnickcom/tcpdf/CVE-2018-17057.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/wallabag/tcpdf/CVE-2018-17057.yaml
• https://github.com/tecnickcom/TCPDF
• https://www.exploit-db.com/exploits/46634
• http://packetstormsecurity.com/files/152200/TCPDF-6.2.19-Deserialization-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/152360/LimeSurvey-Deserialization-Remote-Code-Execution.html
• http://seclists.org/fulldisclosure/2019/Mar/36

CVE-2018-17057 · published 2022-10-06T19:53:20Z · modified 2024-02-16T08:21:52.520485Z · JSON