CVE-2023-50252

Summary

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling <use> tag that references an <image> tag, it merges the attributes from the <use> tag to the <image> tag. The problem pops up especially when the href attribute from the <use> tag has not been sanitized. This can lead to an unsafe file read that can cause PHAR Deserialization vulnerability in PHP prior to version 8. Version 0.5.1 contains a patch for this issue.

Affected Software

Weaknesses

• CWE-15: CWE-15: External Control of System or Configuration Setting
• CWE-502: CWE-502: Deserialization of Untrusted Data

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/dompdf/php-svg-lib/security/advisories/GHSA-jq98-9543-m4cr
• https://github.com/dompdf/php-svg-lib/commit/08ce6a96d63ad7216315fae34a61c886dd2dc030

References

• https://github.com/dompdf/php-svg-lib/security/advisories/GHSA-jq98-9543-m4cr
• https://github.com/dompdf/php-svg-lib/commit/08ce6a96d63ad7216315fae34a61c886dd2dc030

• ←Previous
• Next→