php-svg-lib vulnerabilities

3 known vulnerabilities in php-svg-lib from Dompdf. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  php-svg-lib: Externally Controlled Reference to a Resource in Another Sphere

  CVE-2024-25117Feb 21, 2024Dompdf

  php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't contain a PHAR url, which might leads to RCE on PHP < 8.0, and doesn't validate if external reference

• 9.8 Critical severity

  php-svg-lib: External Control of System or Configuration Setting

  CVE-2023-50252Dec 12, 2023DompdfEPSS 24.8%

  php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attributes from the `<use>` tag to the `<image>` tag. The problem pops up especially when the `href` attri

• 7.5 High severity

  php-svg-lib: Uncontrolled Recursion

  CVE-2023-50251Dec 12, 2023Dompdf

  php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a `use` tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the system configuration and