CVE catalog

CVE-2014-2383

php-dompdf: CVE-2014-2383

[CVE catalog]

Severity
Low
Published
Source
[NVD] · [CVE record]
EPSS
39.37% · Oct 25, 2026

dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianphp-dompdfsid3.1.4+dfsg-2fixed
Debianphp-dompdfbookworm2.0.3+dfsg-1+deb12u1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianphp-dompdfsourcesid0.6.1+dfsg-2unimportantNot reported[745619]
Debianphp-dompdfsourcebookworm0.6.1+dfsg-2unimportantNot reported[745619]

[Debian bug #745619]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [php-dompdf]Fixed
    Details (2)

    • 2.0.3+dfsg-1+deb12u1 · all · bookworm

      Fixed · Fixed: 0.6.1+dfsg-2

      dsa · php-dompdf · debian · bookworm; dsa · php-dompdf · debian · 12

    • 2.0.3+dfsg-1+deb12u1 · all · bookworm

      Fixed · Fixed: 0.6.1+dfsg-2

      dsa · php-dompdf · debian · bookworm; dsa · php-dompdf · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]