[From nobody Tue Sep 15 12:37:08 2026 Received: (at submit) by bugs.debian.org; 24 Aug 2026 13:53:14 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-12.4 required=4.0 tests=BAYES_00, BODY_INCLUDES_PACKAGE,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU, DKIM_VALID_EF,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM,GMAIL, HAS_PACKAGE,HTML_MESSAGE,MULTALT,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE, SPF_PASS autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 24; hammy, 126; neutral, 30; spammy, 0. spammytokens: hammytokens:0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--sk:team@se, 0.000-+--sk:teamse, 0.000-+--D*security.debian.org Return-path: <gajendranath025@gmail.com> Received: from mail-ed1-x534.google.com ([2a00:1450:4864:20::534]:59554) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_128_GCM:128) (Exim 4.96) (envelope-from <gajendranath025@gmail.com>) id 1wyV6w-0017gx-0A for submit@bugs.debian.org; Mon, 24 Aug 2026 13:53:14 +0000 Received: by mail-ed1-x534.google.com with SMTP id 4fb4d7f45d1cf-6a3efa2b38aso6362767a12.2 for <submit@bugs.debian.org>; Mon, 24 Aug 2026 06:53:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1787579592; cv=none; d=google.com; s=arc-20260327; b=nIHfKjtO6iZhXyDW2in0g45HXGMvfYl0H49K7M0xArdTxRcw/YLyxWmtDeIHNhJKnw hyXzz+C2kk/GKboNQgwbzOwTepfW30ZtMKwcyUpme8VOA2NCYrzt1RQ5QC+SMXG5ww7z pdZCkdbSwcidtHa57kYkoEeBsGDzi4+2C6bUkpS7zl/WTbTNKxcnUept4DmIv4f6g1DZ bl8EV+Ib9N3Ihw0bApYfc90cbBflxT7pPFrl3L2fISJ4r+mtU7+qXgRGVO6GlZSnGg4K 9VoxKzMIgvky027LIqqWUsdJ2Et0AhyxtVMStsl+XVhn5nfAdsHGyWkD6id/eRZkrfsc QOPA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=to:subject:message-id:date:from:mime-version:dkim-signature; bh=6JvW3dkLKOM0j1rPvCtygo7vKIccsM63UJoC07z1qHI=; fh=lIR/7veID2U00tj1D35G+ANF85YwqTAbTuNH/WGncTs=; b=FjJDA4PK9SX3vBW8jEodtArA0Sur7Lofxmx0k/iwqpTYhZqxR4nWsEk1aeS/Y9wkdW ohsNIboV6fSAMr36Al5NmUbCl9lRO7VtjaXggRn85WZqNgwTMwuRVxhgiSMiFbXVm/JZ b2x3rCIcZff4m4dWqxpM36kg/HKADCTRPDLotIWLn1GJlDpSN4LrSu1zQx86alxtYTfB aqQfEnkR4I3cCmEef0+g3Exh9zVMFhNw/KyyIkf/4n/ENJ3KH30i+HW6lwduhrjZjpGB pgbEdyfUI/2oxu7BKCPKAZtWUZkqBLhmbLJ0hy4/flIQQ+8YdxD12eWvv3e6v+3N+Z1m GFmA==; darn=bugs.debian.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787579592; x=1788184392; darn=bugs.debian.org; h=content-type:to:subject:message-id:date:from:mime-version:from:to :cc:subject:date:message-id:reply-to:content-type; bh=6JvW3dkLKOM0j1rPvCtygo7vKIccsM63UJoC07z1qHI=; b=HbpL1p+nmDSpzajVHulUherj+aDPz6Q4cJYbCILf7SDFaY2Wx3PGWOCQb+2iBrAdo+ JowlRgzgksledADej0b64L17v5vMjZLWjbNsM7OnqJhet69EYfBNdhBff/Rf9TUNp/Nm LjKhQlKTXO4ks0w3z3gRUu1AucRqcNAg8YC/XC62B7nm49W6bwfU7Ef6vPdI34qsDAKV CM+xx5UX0AYL0talmXIhbNbRTzDWlRMzQ4PAyOc3flGtWGi2TR0n0dz8/oOeBEuzuCQF SHQ5bI7v7Iwi1/jZ1udIjO2oS2FuVOZDuWWR0BaMc/lgmWWW4OqUVkZEqoOqLUwZZH/L PxCQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787579592; x=1788184392; h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=6JvW3dkLKOM0j1rPvCtygo7vKIccsM63UJoC07z1qHI=; b=Fxo7iscz6bSuPCpypFptodajg/2wt/+AYevq+OvUDZmnwbAJjGF/jO7A3rJ7VwPWeh O9A76kDyrvCQSChWOl7H5KV47x9uYdEH2x3yjoC/VkvOzg56vFPm9cxk52dIycvfXC5d gzoMpKZCHm/khS7vCS7XXCV2QxnF4wgvcpuVtJhxPFrGovbEDYbhJbuKFUzmiSZUM9Pi 862c0tl2/pnxdqq8yXcItA0siO7xDbU12bJY8MieO5M08tTLq0UYnJ5EYgXnJ0+p+oZ2 sqPxXZQN9w2oesqZ/6KbgHoiLbU0z7JF6t0OorKYQ6NoyY9c4D55fPCCnNoDvfDc7GcD nVMA== X-Gm-Message-State: AFuF++kqJ1p3ct1iyAZmBb8s27KvTJaE95ELL1wQARBO57lfz2+Oe5mj /9jGqMclK/s/18kofHNTYIPfkUZol4HYV7n1ElI1IwRcXusShLs4moG1/Vw2Rqs+sJRJyASD3vo 97yoBGNOosXp0WORa4SV10DY890bqdJwwq1vmHycuqw== X-Gm-Gg: AR+sD10YRCWnDpXKboFzLhG8QvazYvLz3EQgmqIQR1EesjARiLDSzRJjy0t+DFCspXn h6MrhWHa1WV3YG5/JmsDouonZmPZLSgT8onQeTIYQm1s+vxw4LVIZtGygcCFO62siA8C4luztIW HY0syejgbohWQHGkpYTvQr65+JYyVYmSrO+1NbnfphfXHSgm2+3CPbw5/rTpKL0m3uApUJvPHgo JEktTx8fp+KlZ6KU0laI99oL245CbA+RGwjlyoSKMQdp0YALPnovDc+4k+OPrQctH4Rbv9RbiIS VyDJZneqb21Q9ch0cwTJYPKjd5+y/XoBJxt4t9DbahwlXAqJtbch4L9Ntss0jY4= X-Received: by 2002:a05:6402:4282:b0:6a3:6c99:a5b6 with SMTP id 4fb4d7f45d1cf-6a42f231a70mr30975874a12.14.1787579591753; Mon, 24 Aug 2026 06:53:11 -0700 (PDT) MIME-Version: 1.0 From: Gajendra Nath Soren <gajendranath025@gmail.com> Date: Mon, 24 Aug 2026 19:23:00 +0530 X-Gm-Features: AcwNN1V-sDE4aga177b4v8iGAzPjhgQxsy7WIkAn2CIkGUGDF2OjZOsDonzkaQ4 Message-ID: <CABivTSnBQo5juKrkCbtAZ82w0dRqr08tznNYFo9bHO7z4AX+cA@mail.gmail.com> Subject: icinga-php-thirdparty: please update bundled dompdf (CVE-2026-56722, CVE-2026-55554) To: submit@bugs.debian.org Content-Type: multipart/alternative; boundary="00000000000093022a0659cb4e2b" Delivered-To: submit@bugs.debian.org --00000000000093022a0659cb4e2b Content-Type: text/plain; charset="UTF-8" Package: icinga-php-thirdparty Version: 1.0.0-1 Severity: important Tags: security X-Debbugs-Cc: team@security.debian.org, gajendranath025@gmail.com icinga-php-thirdparty vendors dompdf 3.1.5 at: vendor/dompdf/dompdf/ This version is affected by two vulnerabilities fixed in dompdf 3.1.6: CVE-2026-56722: local file read via SVG images embedded as data-URIs (path validation bypass) CVE-2026-55554: chroot validation bypass via path traversal Please update the bundled dompdf to 3.1.6 or later. The bundled version was confirmed by reading: vendor/dompdf/dompdf/version (contains: 3.1.5) Found by: Attack of the Clones GSoC 2026 pipeline (salsa.debian.org/rouca/gsoc2026) Gajendra --00000000000093022a0659cb4e2b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Package: icinga-php-thirdparty<br>Version: 1.0.0-1<br>Seve= rity: important<br>Tags: security<br>X-Debbugs-Cc: <a href=3D"mailto:team@s= ecurity.debian.org">team@security.debian.org</a>, <a href=3D"mailto:gajendr= anath025@gmail.com">gajendranath025@gmail.com</a><br><br>icinga-php-thirdpa= rty vendors dompdf 3.1.5 at:<br>=C2=A0 vendor/dompdf/dompdf/<br><br>This ve= rsion is affected by two vulnerabilities fixed in dompdf 3.1.6:<br><br>=C2= =A0 CVE-2026-56722: local file read via SVG images embedded as data-URIs<br= >=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 (path valid= ation bypass)<br>=C2=A0 CVE-2026-55554: chroot validation bypass via path t= raversal<br><br>Please update the bundled dompdf to 3.1.6 or later.<br><br>= The bundled version was confirmed by reading:<br>=C2=A0 vendor/dompdf/dompd= f/version (contains: 3.1.5)<br><br>Found by: Attack of the Clones GSoC 2026= pipeline<br>=C2=A0 (<a href=3D"http://salsa.debian.org/rouca/gsoc2026">sal= sa.debian.org/rouca/gsoc2026</a>)<br><br>Gajendra</div> --00000000000093022a0659cb4e2b-- ]