Hello William, hello all, This is just a quick heads-up about my on-going work to prepare a security update for tcpdf, and to avoid any double-work. Among the currently open CVEs [tcpdf], the most complex backport seems to be CVE-2024-32489, since among the two referenced commits, the only one that is actually part of the released code is a "squash [of] multiple fixes" [82fc97b]. My plan is to isolate the changes relevant to the fix. [tcpdf] https://security-tracker.debian.org/tracker/source-package/tcpdf [CVE-2024-32489] https://security-tracker.debian.org/tracker/CVE-2024-32489 [82fc97b] https://github.com/tecnickcom/TCPDF/commit/82fc97bf1c74c8dbe62b1d3cc6d10fa4b87e0262 Please, if you have any thoughts, questions, comments, ... don't hesitate to speak up. Other than that, there is no PoC publicly available for most of the CVEs, and I still need to see how difficult is to test those. Cheers, -- Santiago
Attachment:
signature.asc
Description: PGP signature