CVE-2024-56520: tecnikcom/tc-lib-pdf-font Font Mishandling Vulnerability
Summary
CVE-2024-56520: tecnickcom/tc-lib-pdf-font mishandles fonts. Affects tecnickcom/tc-lib-pdf-font versions < 2.6.4. Fixed in 2.6.4. How to fix ↓
Also tracked for
- tcpdf · Debian:11
The same CVE-2024-56520 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
tecnikcom/tc-lib-pdf-font is a PHP library used for handling fonts in PDF documents. It is commonly utilized in conjunction with TCPDF, a popular PDF generation library. The package provides functionality for managing various font types, including Type 1 and TrueType fonts, which are essential for rendering text accurately in PDFs. However, a vulnerability has been identified that affects how fonts are parsed, leading to potential issues in document rendering.
Vulnerability Detail
An issue was discovered in tc-lib-pdf-font before version 2.6.4, which is also used in TCPDF before version 6.8.0. The vulnerability arises from the mishandling of font data, specifically the misparsing of FontBBox for Type 1 and TrueType fonts. This can lead to incorrect font rendering in generated PDF documents, potentially affecting the visual integrity of the documents and causing confusion for end-users. The vulnerability has been classified as moderate in severity.
How To Fix
Minimum fixed version
2.6.4
This is the first release that contains the fix.
composer require tecnickcom/tc-lib-pdf-font:2.6.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may manually adjust the FontBBox settings in your PDF generation code to mitigate the effects of the mishandling. However, this is not a permanent solution and updating the package is strongly advised.
Conclusion
The vulnerability identified as CVE-2024-56520 in the tecnikcom/tc-lib-pdf-font package poses a moderate risk due to mishandling of font data, affecting PDF rendering. It is crucial to update to version 2.6.4 or later to mitigate this issue and ensure the integrity of generated documents.
See every vulnerability recorded for tecnickcom/tc-lib-pdf-font →
FAQ
The vulnerability can lead to incorrect rendering of fonts in PDF documents, which may confuse users and affect the document's visual integrity.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
Yes, a patch is available in version 2.6.4 of the tc-lib-pdf-font package. Updating to this version will resolve the vulnerability.
If immediate updating is not possible, consider implementing a temporary workaround by adjusting FontBBox settings in your code until you can apply the update.
More information can be found in the advisory published on GitHub and the CVE database, which provide detailed insights into the vulnerability and its implications.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
