-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 29 May 2025 13:17:39 -0300
Source: tcpdf
Architecture: source
Version: 6.6.2+dfsg1-1+deb12u1
Distribution: bookworm-security
Urgency: medium
Maintainer: phpMyAdmin Team <team+phpmyadmin@tracker.debian.org>
Changed-By: Santiago Ruano Rincón <santiagorr@riseup.net>
Changes:
 tcpdf (6.6.2+dfsg1-1+deb12u1) bookworm-security; urgency=medium
 .
   * Exclude quilt managed directory .pc/ from phpab in debian/rules
   * Explicitly specify RELEASE: bookworm in d/gitlab-ci.yml
   * Fix CVE-2024-22640: ReDoS (Regular Expression Denial of Service) if
     parsing an untrusted HTML page with a crafted color
   * Fix CVE-2024-22641: ReDoS (Regular Expression Denial of Service) if
     parsing an untrusted SVG file
   * Fix CVE-2024-32489: tcpdf mishandles calls that use HTML syntax
   * Fix CVE-2024-51058: Local File Inclusion (LFI) vulnerability through <img>
     src tag
   * Fix CVE-2024-56519: setSVGStyles does not sanitize the SVG font-family
     attribute
   * Fix CVE-2024-56520: tcpdf, through its use of tc-lib-pdf-font, mishandles
     fonts like FontBBox for Type 1 and incorrectly parses TrueType fonts
   * Fix CVE-2024-56522: unserializeTCPDFtag doesn't make use of constant-time
     function to compare TCPDF tag hashes
   * Fix CVE-2024-56527: the Error function lacks an htmlspecialchars call for
     the error message
   * Update git branch in the VCS-Git d/control field
Checksums-Sha1:
 7db5274a9f373f41c2cc69e25cd280a36e45240e 1552 tcpdf_6.6.2+dfsg1-1+deb12u1.dsc
 346437fe31df2d5534c553f457f30113dce53280 8001440 tcpdf_6.6.2+dfsg1.orig.tar.xz
 c1353b84081ae9f13387cfcc9944eec472c5b772 16108 tcpdf_6.6.2+dfsg1-1+deb12u1.debian.tar.xz
 7b592b4e6519dea3b81706640a97990afc13fc9d 6552 tcpdf_6.6.2+dfsg1-1+deb12u1_amd64.buildinfo
Checksums-Sha256:
 7aeb4e523175325f9c45ac0b371df1a8fcd72695412375c310b0daf5acdcadae 1552 tcpdf_6.6.2+dfsg1-1+deb12u1.dsc
 d66d1e799a97ca0a012faef45bd64d5d5c4878b46d98105a8be38efaa0f78d4f 8001440 tcpdf_6.6.2+dfsg1.orig.tar.xz
 02fedd8f54ffcd2c4e65cd469cfddc6c354042c46c4d87aef56787e9498248e4 16108 tcpdf_6.6.2+dfsg1-1+deb12u1.debian.tar.xz
 46807be8684b80717ee2d765584ad7f3e1da82bd2ad85d1334f2e322a7cbe43e 6552 tcpdf_6.6.2+dfsg1-1+deb12u1_amd64.buildinfo
Files:
 f9169646024fef66af5b80766550ceb2 1552 php optional tcpdf_6.6.2+dfsg1-1+deb12u1.dsc
 1268c20a20017f0e21849000459a8928 8001440 php optional tcpdf_6.6.2+dfsg1.orig.tar.xz
 60e33cd4a6f079a26bb8849007a2a2db 16108 php optional tcpdf_6.6.2+dfsg1-1+deb12u1.debian.tar.xz
 0412fc7967f9a7970f31c9e0f1a00116 6552 php optional tcpdf_6.6.2+dfsg1-1+deb12u1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iIwEARYKADQWIQR+lHTq7mkJOyB6t2Un3j1FEEiG7wUCaDiVIRYcc2FudGlhZ29y
ckByaXNldXAubmV0AAoJECfePUUQSIbv81gBAJEeUuTNqfSbKQgfRv19jPAtuluH
AuMu1vXYiv7sKTg/AP4gFmSK+MsC6c+z4Wz4oEgFp+H9B/WcMTSdWZv7l9eqAg==
=KWEY
-----END PGP SIGNATURE-----