Vulnerability · Published Dec 12, 2023 · Assigned by GitHub_M
CVE-2023-50252php-svg-lib unsafe attributes merge when parsing `use` tag
High 8.3
In plain English
A high-severity unsafe deserialization in php-svg-lib from dompdf. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 23.9% (higher than 98% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling `<use>` tag that references an `<image>` tag, it merges the attributes from the `<use>` tag to the `<image>` tag. The problem pops up especially when the `href` attribute from the `<use>` tag has not been sanitized. This can lead to an unsafe file read that can cause PHAR Deserialization vulnerability in PHP prior to version 8. Version 0.5.1 contains a patch for this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | php-dompdf-svg-lib | 0.5.0-3+deb12u1 | DEBIAN-CVE-2023-50252 |
| Debian:12 | php-dompdf-svg-lib | 0.5.0-3+deb12u1 | DSA-5642-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| dompdf | php-svg-lib | < 0.5.1 |
Weakness: CWE-15, CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L