Hi,

The following vulnerability was published for tcpdf.

CVE-2024-56527[0]:
| An issue was discovered in TCPDF before 6.8.0. The Error function
| lacks an htmlspecialchars call for the error message.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-56527
https://www.cve.org/CVERecord?id=CVE-2024-56527
[1] https://github.com/tecnickcom/TCPDF/commit/11778aaa2d9e30a9ae1c1ee97ff349344f0ad6e1

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
tcpdf, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1091689@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
William Desportes <williamdes@wdes.fr> (supplier of updated tcpdf package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 28 Dec 2024 11:01:35 +0100
Source: tcpdf
Architecture: source
Version: 6.8.0+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: phpMyAdmin Team <team+phpmyadmin@tracker.debian.org>
Changed-By: William Desportes <williamdes@wdes.fr>
Closes: 1091685 1091686 1091687 1091688 1091689
Changes:
 tcpdf (6.8.0+dfsg-1) unstable; urgency=medium
 .
   * New upstream version 6.8.0+dfsg
       - (CVE-2024-56519, CVE-2024-56520)
       - (CVE-2024-56521, CVE-2024-56522, CVE-2024-56527)
       - (Closes: #1091685, Closes: #1091686)
       - (Closes: #1091687, Closes: #1091688, Closes: #1091689)
   * Depend on php-curl
   * Recommend php-bcmath
Checksums-Sha1:
 3d3b61a46858b798978b6c151e3e2b5dbdc015cd 2096 tcpdf_6.8.0+dfsg-1.dsc
 a1b968f47b80ee066ee6fb5cc60915d58ce7c06b 8000428 tcpdf_6.8.0+dfsg.orig.tar.xz
 560f686385942ce182f91cbbd3ddb2be21e7c267 10112 tcpdf_6.8.0+dfsg-1.debian.tar.xz
 f8262768c1632a5bf116a62743f0fa96172a3103 10133 tcpdf_6.8.0+dfsg-1_source.buildinfo
Checksums-Sha256:
 ba5ae097ee233fd39780d8201488729a32e8e5338312424a37ae5b19bf6e5ab8 2096 tcpdf_6.8.0+dfsg-1.dsc
 defa8c2698967ce72ac27dc9c78ee35c8fb3fb825c931527b7dd62d9a690be53 8000428 tcpdf_6.8.0+dfsg.orig.tar.xz
 c48f116b7218f1414ee1c2bd78fb71d9ec654b702ca96f4011900c6ba94fb84f 10112 tcpdf_6.8.0+dfsg-1.debian.tar.xz
 470c0e254b9a6f78e09cff821441339a4ea1a4d33002c61a787a2b6cd55c257e 10133 tcpdf_6.8.0+dfsg-1_source.buildinfo
Files:
 cecd6f3fa1864bf3b96d1cced367b3d5 2096 php optional tcpdf_6.8.0+dfsg-1.dsc
 9880bae608df27be2b7c0e771918cdfc 8000428 php optional tcpdf_6.8.0+dfsg.orig.tar.xz
 b2ebd443abbc29b684d2f5a6f53e4e0a 10112 php optional tcpdf_6.8.0+dfsg-1.debian.tar.xz
 08ed809161d7d4069dc1e0cbc77a081f 10133 php optional tcpdf_6.8.0+dfsg-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEExNkf3872tKPGU/14kKDvG4JRqIkFAmdztJcACgkQkKDvG4JR
qIlRkA//VJFS3n071UGN2NWqYZQwrqTqvp08Ed5w08TLc5/AOXt7szSoGsP/Dp0W
FmXDYzjquuQSLqr84VqQh0+/QFjsS32UI5+NFaWvLdZ+wt+X6rYhQACeIX4cDBgv
wPx5yEBJWtA+Zim+cp6IPof4iyLto6tKa5BY1PWpq4QZnQOa+NVClglUuCxfXa7T
1YjYLnkiFD5D7lRxo6gI/EFThYWwSUY0g9hbz6/5mClQ4XyLP/jBtciD8/5ynOSr
GH+/UnC2/OdTxO84yuQ1c9HUger/bWShXLZBvI5NckB0PFBLFYHmhMKmGiDws3gY
ue16p4JkAce4cpk4qnMGn6RemurpQfYfptUEtZAzBEx1hV9a9LiAmeujicTusIsC
gZLZ5kXjBqe2+LrRyFI7jhgeuAlGazPVKLTWRTmHGupq/0My/zHXm8USyURnyqP9
PUsOIclGgF9WlYxUmnAsoS1riaKTb2qYltKAIrXAm90BZRCr1Sy5m8H+z8fGfrc/
69JLQPZqz0yZnViDD7p90JzWR+q3meYD63QDm+Xjkh0hZvXivHxbJ8q9bTHQlq6C
tkgcqjS+rE8YTz5pfoHJbZXjptCvQRBgkzmHlIZB1I5mXUpUs5gFIDHYIzkZzr6x
tAgdo7coOeuLixuwKerfJHnXyJg12EAAmPy+burZxWjlssR4vlo=
=ei5u
-----END PGP SIGNATURE-----