Open mend-bolt-for-github[bot] opened 1 year ago
DOMPDF is a CSS 2.1 compliant HTML to PDF converter
Library home page: https://api.github.com/repos/dompdf/dompdf/zipball/79573d8b8a141ec8a17312515de8740eed014fa9
Dependency Hierarchy: - :x: **dompdf/dompdf-v2.0.0** (Vulnerable Library)
Found in base branch: master
registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.
Publish Date: 2022-09-25
URL: CVE-2022-41343
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
Type: Upgrade version
Release Date: 2022-09-25
Fix Resolution: v2.0.1
Step up your Open Source Security Game with Mend here
CVE-2022-41343 - High Severity Vulnerability
DOMPDF is a CSS 2.1 compliant HTML to PDF converter
Library home page: https://api.github.com/repos/dompdf/dompdf/zipball/79573d8b8a141ec8a17312515de8740eed014fa9
Dependency Hierarchy: - :x: **dompdf/dompdf-v2.0.0** (Vulnerable Library)
Found in base branch: master
registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.
Publish Date: 2022-09-25
URL: CVE-2022-41343
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Release Date: 2022-09-25
Fix Resolution: v2.0.1
Step up your Open Source Security Game with Mend here