Denial of Service Vulnerability in php-dompdf: CVE-2014-5012
Summary
CVE-2014-5012: DOMPDF before 0.6.2 allows denial of service. Affects php-dompdf versions < 0.6.2+dfsg-1. Fixed in 0.6.2+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
php-dompdf is a popular PHP library that enables the conversion of HTML to PDF documents. It is widely used in web applications for generating dynamic PDF files from HTML content. The library supports various features such as CSS styling and image embedding, making it a versatile tool for developers. However, certain versions of php-dompdf are vulnerable to a denial of service (DoS) attack, which can disrupt the functionality of applications relying on this library.
Vulnerability Detail
CVE-2014-5012 is a denial of service vulnerability found in php-dompdf versions prior to 0.6.2. This vulnerability arises from improper handling of certain inputs, which can lead to excessive resource consumption when processing documents. An attacker can exploit this vulnerability by sending specially crafted HTML content to the library, causing the application to hang or crash. The potential ramifications include service downtime and degraded performance of applications that utilize php-dompdf, impacting user experience and operational efficiency.
How To Fix
Minimum fixed version
0.6.2+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php-dompdfTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing input validation to filter out potentially malicious HTML content before it is processed by php-dompdf. This can help mitigate the risk of denial of service attacks.
Conclusion
CVE-2014-5012 is a significant denial of service vulnerability in php-dompdf that can impact applications relying on this library. Upgrading to the latest version is crucial to ensure the security and stability of your applications. Additionally, implementing input validation can serve as a temporary mitigation strategy.
See every vulnerability recorded for php-dompdf →
FAQ
CVE-2014-5012 is a vulnerability in php-dompdf that allows for denial of service attacks due to improper input handling.
Versions of php-dompdf prior to 0.6.2 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to service downtime and degraded performance, affecting user experience and operational efficiency.
Yes, implementing input validation to filter out potentially malicious HTML content can help mitigate the risk of denial of service attacks.
Related vulnerabilities
Recent vulnerabilities recorded for php-dompdf.
