FEDORA-2024-d6b0e72e3d — security update for php-tcpdf

stable

php-tcpdf-6.8.0-1.fc40

FEDORA-2024-d6b0e72e3d created by remi a year ago for Fedora 40

Version 6.8.0 (2024-12-23)

Requires PHP 7.1+ and curl extension.
Escape error message.
Use strict time-constant function to compare TCPDF-tag hashes.
Add K_CURLOPTS config array to set custom cURL options (NOTE: some defaults have changed).
Add some addTTFfont fixes from tc-lib-pdf-font.

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2024-d6b0e72e3d

This update has been submitted for testing by remi.

a year ago

This update's test gating status has been changed to 'ignored'.

a year ago

remi edited this update.

a year ago

This update has been pushed to testing.

a year ago

This update has been submitted for stable by bodhi.

a year ago

This update has been pushed to stable.

a year ago

Please log in to add feedback.

Metadata

Type

security

Severity

low

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

7 days

Dates

submitted

a year ago

in testing

a year ago

in stable

a year ago

modified

a year ago

approved

a year ago

Builds

php-tcpdf-6.8.0-1.fc40

BZ#2334288 CVE-2024-56522 php-tcpdf: unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes [fedora-40]

BZ#2334292 CVE-2024-56519 php-tcpdf: setSVGStyles does not sanitize the SVG font-family attribute [fedora-40]

BZ#2334297 CVE-2024-56521 php-tcpdf: CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely when libcurl is used [fedora-40]

BZ#2334342 CVE-2024-56527 php-tcpdf: Error function lacks an htmlspecialchars call for the error message. [fedora-40]

php-tcpdf-6.8.0-1.fc40

Automated Test Results

ignored