Path: csiph.com!fu-berlin.de!bofh.it!news.nic.it!robomod From: Debian FTP Masters Newsgroups: linux.debian.changes Subject: Accepted tcpdf 6.6.2+dfsg1-1+deb12u1 (source) into proposed-updates Date: Tue, 03 Jun 2025 20:10:01 +0200 Message-ID: X-Mailbox-Line: From debian-changes-request@lists.debian.org Tue Jun 3 18:02:40 2025 Old-Return-Path: X-Spam-Flag: NO X-Spam-Score: -110.29 X-Dak: dak process-policy X-Debian: DAK X-Debian-Package: tcpdf Debian: DAK Debian-Changes: tcpdf_6.6.2+dfsg1-1+deb12u1_source.changes Debian-Source: tcpdf Debian-Version: 6.6.2+dfsg1-1+deb12u1 Debian-Architecture: source Debian-Suite: proposed-updates Debian-Archive-Action: accept MIME-Version: 1.0 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============1046467742697790446==" X-Debian-Message: from DAK Reply-To: debian-devel@lists.debian.org Mail-Followup-To: debian-devel@lists.debian.org X-Mailing-List: archive/latest/17049 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/E1uMVy1-000RDd-Lq@fasolo.debian.org Approved: robomod@news.nic.it Lines: 86 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Tue, 03 Jun 2025 18:02:29 +0000 X-Original-Message-ID: Xref: csiph.com linux.debian.changes:12461 --===============1046467742697790446== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 29 May 2025 13:17:39 -0300 Source: tcpdf Architecture: source Version: 6.6.2+dfsg1-1+deb12u1 Distribution: bookworm-security Urgency: medium Maintainer: phpMyAdmin Team Changed-By: Santiago Ruano Rinc=C3=B3n Changes: tcpdf (6.6.2+dfsg1-1+deb12u1) bookworm-security; urgency=3Dmedium . * Exclude quilt managed directory .pc/ from phpab in debian/rules * Explicitly specify RELEASE: bookworm in d/gitlab-ci.yml * Fix CVE-2024-22640: ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color * Fix CVE-2024-22641: ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file * Fix CVE-2024-32489: tcpdf mishandles calls that use HTML syntax * Fix CVE-2024-51058: Local File Inclusion (LFI) vulnerability through src tag * Fix CVE-2024-56519: setSVGStyles does not sanitize the SVG font-family attribute * Fix CVE-2024-56520: tcpdf, through its use of tc-lib-pdf-font, mishandles fonts like FontBBox for Type 1 and incorrectly parses TrueType fonts * Fix CVE-2024-56522: unserializeTCPDFtag doesn't make use of constant-time function to compare TCPDF tag hashes * Fix CVE-2024-56527: the Error function lacks an htmlspecialchars call for the error message * Update git branch in the VCS-Git d/control field Checksums-Sha1: 7db5274a9f373f41c2cc69e25cd280a36e45240e 1552 tcpdf_6.6.2+dfsg1-1+deb12u1.dsc 346437fe31df2d5534c553f457f30113dce53280 8001440 tcpdf_6.6.2+dfsg1.orig.tar.= xz c1353b84081ae9f13387cfcc9944eec472c5b772 16108 tcpdf_6.6.2+dfsg1-1+deb12u1.d= ebian.tar.xz 7b592b4e6519dea3b81706640a97990afc13fc9d 6552 tcpdf_6.6.2+dfsg1-1+deb12u1_am= d64.buildinfo Checksums-Sha256: 7aeb4e523175325f9c45ac0b371df1a8fcd72695412375c310b0daf5acdcadae 1552 tcpdf_= 6.6.2+dfsg1-1+deb12u1.dsc d66d1e799a97ca0a012faef45bd64d5d5c4878b46d98105a8be38efaa0f78d4f 8001440 tcp= df_6.6.2+dfsg1.orig.tar.xz 02fedd8f54ffcd2c4e65cd469cfddc6c354042c46c4d87aef56787e9498248e4 16108 tcpdf= _6.6.2+dfsg1-1+deb12u1.debian.tar.xz 46807be8684b80717ee2d765584ad7f3e1da82bd2ad85d1334f2e322a7cbe43e 6552 tcpdf_= 6.6.2+dfsg1-1+deb12u1_amd64.buildinfo Files: f9169646024fef66af5b80766550ceb2 1552 php optional tcpdf_6.6.2+dfsg1-1+deb12= u1.dsc 1268c20a20017f0e21849000459a8928 8001440 php optional tcpdf_6.6.2+dfsg1.orig= .tar.xz 60e33cd4a6f079a26bb8849007a2a2db 16108 php optional tcpdf_6.6.2+dfsg1-1+deb1= 2u1.debian.tar.xz 0412fc7967f9a7970f31c9e0f1a00116 6552 php optional tcpdf_6.6.2+dfsg1-1+deb12= u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iIwEARYKADQWIQR+lHTq7mkJOyB6t2Un3j1FEEiG7wUCaDiVIRYcc2FudGlhZ29y ckByaXNldXAubmV0AAoJECfePUUQSIbv81gBAJEeUuTNqfSbKQgfRv19jPAtuluH AuMu1vXYiv7sKTg/AP4gFmSK+MsC6c+z4Wz4oEgFp+H9B/WcMTSdWZv7l9eqAg=3D=3D =3DKWEY -----END PGP SIGNATURE----- --===============1046467742697790446== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCaD84tQAKCRCb9qggYcy5 ITiEAP9Ft5i1lho0d6wWzqSHotoTGi/7wqMKeqWFz2KB2bUrBwEA8bpzYUygISh5 iEqX51b0LCntYCyx9JWKckJJMHQBegQ= =H7CG -----END PGP SIGNATURE----- --===============1046467742697790446==--