Fluid Attacks Database

Description

TCPDF vulnerable to Regular Expression Denial of Service TCPDF version <= 6.7.4 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	tcpdf	=6.6.2+dfsg1-1 \|\| >=0 <6.6.2+dfsg1-1+deb12u1	6.6.2+dfsg1-1+deb12u1
debian 11	tcpdf	=6.3.5+dfsg1-1 \|\| >=0 <6.3.5+dfsg1-1+deb11u1	6.3.5+dfsg1-1+deb11u1
debian 13	tcpdf	>=0 <6.7.5+dfsg-1	6.7.5+dfsg-1
packagist	tecnickcom/tcpdf	>=0 <6.7.5	6.7.5
debian 14	tcpdf	>=0 <6.7.5+dfsg-1	6.7.5+dfsg-1

Aliases

1. CVE-2024-226402. NVD-2024-226403. OSV-DEBIAN-2024-226404. OSV-2024-226405. GCVE-2024-226406. SECURITY-TRACKER-CVE-2024-226407. lists.debian.org

References

1. https://github.com/zunak/CVE-2024-226402. https://github.com/tecnickcom/TCPDF/commit/05f3a28f4a7905019469e040cf77e53d6aa7f6793. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LIB3R2WB7XPW2I4PGVMZ3VLFLRHOK4RB4. https://lists.fedoraproject.org/archives/list/[email protected]/message/LIB3R2WB7XPW2I4PGVMZ3VLFLRHOK4RB

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.