CVE-2014-2383

dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 97%
VendorProductVersion
dompdfdompdf
𝑥
≤ 0.6.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
php-dompdf
bullseye
0.6.2+dfsg-3.1
fixed
bookworm
2.0.3+dfsg-1
fixed
sid
3.0.0+dfsg-2
fixed
trixie
3.0.0+dfsg-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
php-dompdf
disco
not-affected
cosmic
not-affected
bionic
not-affected
artful
not-affected
zesty
not-affected
yakkety
not-affected
xenial
not-affected
wily
not-affected
vivid
not-affected
utopic
not-affected
trusty
dne
saucy
dne
quantal
dne
precise
dne
lucid
dne
Common Weakness Enumeration
References
http://seclists.org/fulldisclosure/2014/Apr/258
http://www.securityfocus.com/archive/1/531912/100/0/threaded
https://explore.avertium.com/resource/lfi-rfi-escalation-to-rce
https://github.com/dompdf/dompdf/commit/23a693993299e669306929e3d49a4a1f7b3fb028
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383/
http://seclists.org/fulldisclosure/2014/Apr/258
http://www.securityfocus.com/archive/1/531912/100/0/threaded
https://explore.avertium.com/resource/lfi-rfi-escalation-to-rce
https://github.com/dompdf/dompdf/commit/23a693993299e669306929e3d49a4a1f7b3fb028
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383/