crítica
CVE-2018-17057
An issue was discovered in TCPDF before 6.2.22. Attackers can trigger ...
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Ubuntu (media).
Descripción
An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| composer::GitHub Security Advisory Composer | fooman/tcpdf, la-haute-societe/tcpdf, spoonity/tcpdf y 1 más | 6.2.22 |
| composer::PHP Security Advisories Database | fooman/tcpdf, fossar/tcpdf-parser, la-haute-societe/tcpdf y 3 más | sin corrección indicada |
| debian 11 | tcpdf | 6.2.26+dfsg-1 |
| debian 12 | tcpdf | 6.2.26+dfsg-1 |
| debian 13 | tcpdf | 6.2.26+dfsg-1 |
| debian 14 | tcpdf | 6.2.26+dfsg-1 |
| debian 8 | tcpdf | sin corrección indicada |
| debian 9 | tcpdf | sin corrección indicada |
| echo | tcpdf | 6.2.26+dfsg-1 |
| ubuntu 18.04-ESM | tcpdf | sin corrección indicada |
| ubuntu 20.04-ESM | tcpdf | sin corrección indicada |
| ubuntu 22.04 | tcpdf | sin corrección indicada |
Mostrar las 20 entradas de 12 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| composer::GitHub Security Advisory Composer | fooman/tcpdf | 6.2.22 |
| composer::GitHub Security Advisory Composer | la-haute-societe/tcpdf | 6.2.22 |
| composer::GitHub Security Advisory Composer | spoonity/tcpdf | 6.2.22 |
| composer::GitHub Security Advisory Composer | tecnickcom/tcpdf | 6.2.22 |
| composer::PHP Security Advisories Database | fooman/tcpdf | sin corrección indicada |
| composer::PHP Security Advisories Database | fossar/tcpdf-parser | sin corrección indicada |
| composer::PHP Security Advisories Database | la-haute-societe/tcpdf | sin corrección indicada |
| composer::PHP Security Advisories Database | spoonity/tcpdf | sin corrección indicada |
| composer::PHP Security Advisories Database | tecnickcom/tcpdf | sin corrección indicada |
| composer::PHP Security Advisories Database | wallabag/tcpdf | sin corrección indicada |
| debian 11 | tcpdf | 6.2.26+dfsg-1 |
| debian 12 | tcpdf | 6.2.26+dfsg-1 |
| debian 13 | tcpdf | 6.2.26+dfsg-1 |
| debian 14 | tcpdf | 6.2.26+dfsg-1 |
| debian 8 | tcpdf | sin corrección indicada |
| debian 9 | tcpdf | sin corrección indicada |
| echo | tcpdf | 6.2.26+dfsg-1 |
| ubuntu 18.04-ESM | tcpdf | sin corrección indicada |
| ubuntu 20.04-ESM | tcpdf | sin corrección indicada |
| ubuntu 22.04 | tcpdf | sin corrección indicada |
Referencias
- http://packetstormsecurity.com/files/152200/TCPDF-6.2.19-Deserialization-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/152360/LimeSurvey-Deserialization-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2019/Mar/36
- https://contao.org/en/news/security-vulnerability-cve-2018-17057.html
- https://github.com/FriendsOfPHP/security-advisories/blob/master/fooman/tcpdf/CVE-2018-17057.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/la-haute-societe/tcpdf/CVE-2018-17057.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/spoonity/tcpdf/CVE-2018-17057.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/tecnickcom/tcpdf/CVE-2018-17057.yaml
Las 17 referencias
- https://github.com/FriendsOfPHP/security-advisories/blob/master/wallabag/tcpdf/CVE-2018-17057.yaml
- https://github.com/LimeSurvey/LimeSurvey/commit/1cdd78d27697b3150bb44aaa7af1a81062a591a5
- https://github.com/tecnickcom/TCPDF
- https://github.com/tecnickcom/TCPDF/commit/1861e33fe05f653b67d070f7c106463e7a5c26e
- https://github.com/tecnickcom/TCPDF/commit/1861e33fe05f653b67d070f7c106463e7a5c26ed
- https://nvd.nist.gov/vuln/detail/CVE-2018-17057
- https://www.cve.org/CVERecord?id=CVE-2018-17057
- https://www.exploit-db.com/exploits/46634
- https://www.exploit-db.com/exploits/46634/