Register | Log in

tcpdf

PHP class for generating PDF files on-the-fly

Choose email to subscribe with

general

source: tcpdf (main)
version: 6.8.0+dfsg-1
maintainer: phpMyAdmin Team (DMD)
uploaders: William Desportes [DMD] [DM]
arch: all
std-ver: 4.7.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 6.3.5+dfsg1-1
old-bpo: 6.6.2+dfsg1-1~bpo11+1
stable: 6.6.2+dfsg1-1
testing: 6.8.0+dfsg-1
unstable: 6.8.0+dfsg-1

versioned links

6.3.5+dfsg1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.6.2+dfsg1-1~bpo11+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.6.2+dfsg1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.8.0+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

php-tcpdf

action needed

9 security issues in bullseye high

There are 9 open security issues in bullseye.

6 important issues:

CVE-2024-51058: Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user to read arbitrary files from the server's file system through <img> src tag, potentially exposing sensitive information.
CVE-2024-56519: An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute.
CVE-2024-56520: An issue was discovered in tc-lib-pdf-font before 2.6.4, as used in TCPDF before 6.8.0 and other products. Fonts are mishandled, e.g., FontBBox for Type 1 and TrueType fonts is misparsed.
CVE-2024-56521: An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.
CVE-2024-56522: An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes.
CVE-2024-56527: An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.

3 issues postponed or untriaged:

CVE-2024-22640: (needs triaging) TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.
CVE-2024-22641: (needs triaging) TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.
CVE-2024-32489: (needs triaging) TCPDF before 6.7.4 mishandles calls that use HTML syntax.

Created: 2024-11-26 Last update: 2025-01-02 05:00

9 security issues in bookworm high

There are 9 open security issues in bookworm.

6 important issues:

CVE-2024-51058: Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user to read arbitrary files from the server's file system through <img> src tag, potentially exposing sensitive information.
CVE-2024-56519: An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute.
CVE-2024-56520: An issue was discovered in tc-lib-pdf-font before 2.6.4, as used in TCPDF before 6.8.0 and other products. Fonts are mishandled, e.g., FontBBox for Type 1 and TrueType fonts is misparsed.
CVE-2024-56521: An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.
CVE-2024-56522: An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes.
CVE-2024-56527: An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.

3 issues left for the package maintainer to handle:

CVE-2024-22640: (needs triaging) TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.
CVE-2024-22641: (needs triaging) TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.
CVE-2024-32489: (needs triaging) TCPDF before 6.7.4 mishandles calls that use HTML syntax.

You can find information about how to handle these issues in the security team's documentation.

Created: 2024-04-15 Last update: 2025-01-02 05:00

8 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 86ac69ded90b2c793853dff099e809565e2de964
Author: William Desportes <williamdes@wdes.fr>
Date:   Tue Dec 31 10:07:14 2024 +0100

    Send 6.8.0+dfsg-1 to unstable

commit aab82116d134a3b93ea48cd3282d2413ab8754c7
Author: William Desportes <williamdes@wdes.fr>
Date:   Tue Dec 31 09:56:52 2024 +0100

    d/ch

commit 8224ea65de35e811d0b680f656701a25822d98a0
Author: William Desportes <williamdes@wdes.fr>
Date:   Tue Dec 31 09:56:42 2024 +0100

    Add curl to DEP-8 tests

commit f5b70710637951265d7a1cd1fa98b239330c57f0
Author: William Desportes <williamdes@wdes.fr>
Date:   Sat Dec 28 14:23:53 2024 +0100

    d/ch

commit 8c89a940b37f1173f1fca9d25f019b77cbaa8ded
Author: William Desportes <williamdes@wdes.fr>
Date:   Sat Dec 28 14:21:48 2024 +0100

    Depend on php-curl, recommend php-bcmath

commit 167a6adc2713e3647582b854a4f8bb66f7f9b1dd
Author: William Desportes <williamdes@wdes.fr>
Date:   Sat Dec 28 11:02:51 2024 +0100

    d/ch

commit 93244c60f58521d81280361f0856c239eee5425e
Merge: 2ab125a bf08117
Author: William Desportes <williamdes@wdes.fr>
Date:   Sat Dec 28 11:00:51 2024 +0100

    Update upstream source from tag 'upstream/6.8.0+dfsg'
    
    Update to upstream version '6.8.0+dfsg'
    with Debian dir 861a79df595f22f444f48fd136190db98174073d

commit bf08117a9d508c748bd55cd35bd652a2b4ba07bc
Author: William Desportes <williamdes@wdes.fr>
Date:   Sat Dec 28 11:00:37 2024 +0100

    New upstream version 6.8.0+dfsg

Created: 2024-12-28 Last update: 2025-01-14 18:30

news

[2025-01-02] tcpdf 6.8.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2024-12-31] Accepted tcpdf 6.8.0+dfsg-1 (source) into unstable (William Desportes)
[2024-12-14] tcpdf 6.7.7+dfsg-1 MIGRATED to testing (Debian testing watch)
[2024-12-12] Accepted tcpdf 6.7.7+dfsg-1 (source) into unstable (William Desportes)
[2024-04-24] tcpdf 6.7.5+dfsg-1 MIGRATED to testing (Debian testing watch)
[2024-04-20] Accepted tcpdf 6.7.5+dfsg-1 (source) into unstable (William Desportes)
[2024-04-08] tcpdf 6.7.4+dfsg-1 MIGRATED to testing (Debian testing watch)
[2024-04-06] Accepted tcpdf 6.7.4+dfsg-1 (source) into unstable (William Desportes)
[2023-09-09] tcpdf 6.6.5+dfsg-1 MIGRATED to testing (Debian testing watch)
[2023-09-06] Accepted tcpdf 6.6.5+dfsg-1 (source) into unstable (William Desportes)
[2023-09-06] Accepted tcpdf 6.6.3+dfsg1-1 (source) into unstable (William Desportes)
[2023-01-24] Accepted tcpdf 6.6.2+dfsg1-1~bpo11+1 (source all) into bullseye-backports (Debian FTP Masters) (signed by: James Valleroy)
[2022-12-26] tcpdf 6.6.2+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2022-12-23] Accepted tcpdf 6.6.2+dfsg1-1 (source) into unstable (William Desportes)
[2022-12-08] tcpdf 6.6.0+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2022-12-06] Accepted tcpdf 6.6.0+dfsg1-1 (source) into unstable (William Desportes)
[2022-09-04] Accepted tcpdf 6.5.0+dfsg1-1~bpo10+1 (source) into buster-backports->backports-policy, buster-backports (Debian FTP Masters) (signed by: William Desportes)
[2022-08-14] tcpdf 6.5.0+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2022-08-12] Accepted tcpdf 6.5.0+dfsg1-1 (source) into unstable (William Desportes)
[2022-01-08] tcpdf 6.4.4+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2022-01-05] Accepted tcpdf 6.4.4+dfsg1-1 (source) into unstable (William Desportes)
[2021-08-23] tcpdf 6.4.2+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2021-08-19] Accepted tcpdf 6.4.2+dfsg1-1 (source) into unstable (William Desportes)
[2020-04-14] Accepted tcpdf 6.3.5+dfsg1-1~bpo10+1 (source all) into buster-backports, buster-backports (Debian FTP Masters) (signed by: Utkarsh Gupta)
[2020-03-18] tcpdf 6.3.5+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2020-03-16] Accepted tcpdf 6.3.5+dfsg1-1 (source) into unstable (Felipe Sateler)
[2020-02-18] tcpdf 6.3.4+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2020-02-16] Accepted tcpdf 6.3.4+dfsg1-1 (source) into unstable (Felipe Sateler)
[2019-10-23] tcpdf 6.3.2+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2019-10-20] Accepted tcpdf 6.3.2+dfsg1-1 (source) into unstable (Felipe Sateler)

1
2

bugs [bug history graph]

all: 0

links

homepage
lintian
buildd: logs, reproducibility
popcon
browse source code
edit tags
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 6.8.0+dfsg-1

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing