logo

Database

Insecure deserialization In tecnickcom/tcpdf

Description

TCPDF vulnerable to attackers triggering deserialization of arbitrary data An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2018-170572. NVD-2018-170573. OSV-2018-170574. OSV-DEBIAN-2018-170575. GCVE-2018-170576. SECURITY-TRACKER-CVE-2018-17057

References

1. https://github.com/LimeSurvey/LimeSurvey/commit/1cdd78d27697b3150bb44aaa7af1a81062a591a52. https://github.com/tecnickcom/TCPDF/commit/1861e33fe05f653b67d070f7c106463e7a5c26ed3. https://contao.org/en/news/security-vulnerability-cve-2018-17057.html4. https://github.com/FriendsOfPHP/security-advisories/blob/master/fooman/tcpdf/CVE-2018-17057.yaml5. https://github.com/FriendsOfPHP/security-advisories/blob/master/la-haute-societe/tcpdf/CVE-2018-17057.yaml6. https://github.com/FriendsOfPHP/security-advisories/blob/master/spoonity/tcpdf/CVE-2018-17057.yaml7. https://github.com/FriendsOfPHP/security-advisories/blob/master/tecnickcom/tcpdf/CVE-2018-17057.yaml8. https://github.com/FriendsOfPHP/security-advisories/blob/master/wallabag/tcpdf/CVE-2018-17057.yaml9. https://www.exploit-db.com/exploits/4663410. http://packetstormsecurity.com/files/152200/TCPDF-6.2.19-Deserialization-Remote-Code-Execution.html11. http://packetstormsecurity.com/files/152360/LimeSurvey-Deserialization-Remote-Code-Execution.html12. http://seclists.org/fulldisclosure/2019/Mar/36

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.