Information Disclosure Vulnerability in php-dompdf Package (CVE-2014-5011)
Summary
CVE-2014-5011: DOMPDF before 0.6.2 allows Information Disclosure. Affects php-dompdf versions < 0.6.2+dfsg-1. Fixed in 0.6.2+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
php-dompdf is a popular PHP library that converts HTML to PDF documents. It is widely used in web applications to generate PDF files dynamically from HTML content. The library supports various features such as CSS styling, images, and fonts, making it a versatile tool for developers. However, prior to version 0.6.2, php-dompdf had a vulnerability that could lead to information disclosure, potentially exposing sensitive data to unauthorized users.
Vulnerability Detail
CVE-2014-5011 is a vulnerability in php-dompdf that allows for information disclosure. This issue arises from improper handling of certain input data, which could enable an attacker to access sensitive information that should otherwise be protected. If exploited, this vulnerability could lead to unauthorized access to confidential data, posing a significant risk to applications that rely on this library for PDF generation.
How To Fix
Minimum fixed version
0.6.2+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php-dompdfTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider implementing input validation and sanitization to mitigate the risk of information disclosure. Ensure that any user input is properly validated before being processed by the php-dompdf library.
Conclusion
The CVE-2014-5011 vulnerability in the php-dompdf package poses a significant risk of information disclosure. It is crucial for developers using this library to upgrade to the latest version to mitigate potential security threats. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for php-dompdf →
FAQ
CVE-2014-5011 is a vulnerability in the php-dompdf library that allows for information disclosure due to improper handling of input data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could lead to unauthorized access to sensitive information, which may compromise user data and application integrity.
Yes, upgrading to php-dompdf version 0.6.2+dfsg-1 or later will resolve the vulnerability.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json. It provides real-time alerts for vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for php-dompdf.
