CVE-2022-41343 - registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule

Back Back to CVE browser

HIGH

registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule

Published Sep 25, 2022

7.5

HIGH

CVSS 3.1

EPSS 5.98%

Description

registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-552

References (8)

https://github.com/FriendsOfPHP/security-advisories/blob/master/dompdf/dompdf/CVE-2022-41343.yaml
https://github.com/advisories/GHSA-6x28-7h8c-chx4
Advisory
https://github.com/dompdf/dompdf/commit/66431c58017d5b1bdb9f6f772b9fbbc5e3d38dc2
https://github.com/dompdf/dompdf/issues/2994
ExploitIssue TrackingPatchThird Party Advisory
https://github.com/dompdf/dompdf/pull/2995
PatchThird Party Advisory
https://github.com/dompdf/dompdf/releases/tag/v2.0.1
Release NotesThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-41343
https://tantosec.com/blog/cve-2022-41343/
exploitThird Party Advisory

Link	Providers	Tags
https://github.com/FriendsOfPHP/security-advisories/blob/master/dompdf/dompdf/CVE-2022-41343.yaml
https://github.com/advisories/GHSA-6x28-7h8c-chx4		Advisory
https://github.com/dompdf/dompdf/commit/66431c58017d5b1bdb9f6f772b9fbbc5e3d38dc2
https://github.com/dompdf/dompdf/issues/2994		ExploitIssue TrackingPatchThird Party Advisory
https://github.com/dompdf/dompdf/pull/2995		PatchThird Party Advisory
https://github.com/dompdf/dompdf/releases/tag/v2.0.1		Release NotesThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-41343
https://tantosec.com/blog/cve-2022-41343/		exploitThird Party Advisory