[pkg-php-pear] Bug#1010090: php-dompdf: CVE-2022-28368
carnil at debian.org
Sun Apr 24 09:54:18 BST 2022
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
The following vulnerability was published for php-dompdf.
I raise this as grave to ask the following question as well from
future inclusion in bookworm: Is php-dompdf still maintained? I notice
that it's at version 0.6.2 since stretch with one single NMU from the
reproducible builds team. Or should it be removed from Debian?
| Dompdf 1.2.1 allows remote code execution via a .php file in the
| src:url field of an @font-face Cascading Style Sheets (CSS) statement
| (within an HTML input file).
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
More information about the pkg-php-pear