Command Injection in libitext5-java
Summary
DSA-5323-1: libitext5-java - security update. Affects libitext5-java versions < 5.5.13.2-1+deb11u1. Fixed in 5.5.13.2-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libitext5-java is a Java PDF library that utilizes the external ghostscript software to compare PDFs at a pixel level. It provides functionality for creating, manipulating, and comparing PDF documents. The library is widely used in various applications for PDF generation and processing.
Vulnerability Detail
The CompareTool component of libitext5-java is susceptible to command injection when parsing a specially crafted filename. This vulnerability allows an attacker to inject arbitrary commands into the system, potentially leading to remote code execution or unauthorized access to sensitive information. The issue arises due to improper input validation and sanitization of filenames, enabling an attacker to execute arbitrary commands during the comparison process.
How To Fix
Minimum fixed version
5.5.13.2-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libitext5-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by upgrading to the patched version of libitext5-java.
Conclusion
The command injection vulnerability in libitext5-java poses a significant risk to systems utilizing the library for PDF processing. It is crucial to upgrade to the patched version to mitigate the potential impact of this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libitext5-java →
FAQ
libitext5-java is a Java PDF library used for creating, manipulating, and comparing PDF documents.
The vulnerability allows an attacker to execute arbitrary commands, potentially leading to remote code execution or unauthorized access to sensitive information.
To fix this vulnerability, upgrade the libitext5-java package to version 5.5.13.2-1+deb11u1 or later.
No, there is no known workaround for this vulnerability. It is crucial to apply the provided fix by upgrading to the patched version of libitext5-java.
You can find more information about this vulnerability in the security tracker page for libitext5-java: https://security-tracker.debian.org/tracker/libitext5-java
Related vulnerabilities
Recent vulnerabilities recorded for libitext5-java.
