CVE catalog

CVE-2023-50251

php-dompdf-svg-lib affected and fixed versions

[CVE catalog]

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a `use` tag inside an svg document, an attacker can cause the system to go to an infinite recursion. Depending on the system configuration and attack pattern this could exhaust the memory available to the executing process and/or to the server itself. An attacker sending multiple request to a system to render the above payload can potentially cause resource exhaustion to the point that the system is unable to handle incoming request. Version 0.5.1 contains a patch for this issue.

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.88% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiansidphp-dompdf-svg-lib0.5.1-1FixedDistribution-reported fixed boundary[CVE-2023-50251]
Debiansidphp-dompdf-svg-lib1.0.0-2Fixed[CVE-2023-50251]
Debianbookworm-securityphp-dompdf-svg-lib0.5.0-3+deb12u1Fixed[CVE-2023-50251]
Debianbookwormphp-dompdf-svg-lib0.5.0-3+deb12u1FixedDistribution-reported fixed boundary[CVE-2023-50251]
Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormphp-dompdf-svg-lib0.5.0-3+deb12u1FixedDistribution-reported fixed boundary[CVE-2023-50251]
Debianbookworm-securityphp-dompdf-svg-lib0.5.0-3+deb12u1Fixed[CVE-2023-50251]
Debiansidphp-dompdf-svg-lib0.5.1-1FixedDistribution-reported fixed boundary[CVE-2023-50251]
Debiansidphp-dompdf-svg-lib1.0.0-2Fixed[CVE-2023-50251]
Original provider fields
{
  "package_releases": [
    {
      "name": "php-dompdf-svg-lib",
      "status": "fixed",
      "release": "sid",
      "version": "1.0.0-2"
    },
    {
      "name": "php-dompdf-svg-lib",
      "status": "fixed",
      "release": "bookworm",
      "version": "0.5.0-3+deb12u1"
    },
    {
      "name": "php-dompdf-svg-lib",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "0.5.0-3+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1058641,
      "name": "php-dompdf-svg-lib",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "0.5.1-1"
    },
    {
      "bug": 1058641,
      "name": "php-dompdf-svg-lib",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "0.5.0-3+deb12u1"
    }
  ],
  "distribution_packages": []
}

[Debian bug #1058641]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [php-dompdf-svg-lib]Unknown
    Details (4)

    • 0.5.0-3+deb12u1 · all · bookworm

      Fixed · Fixed: 0.5.0-3+deb12u1

      dsa · php-dompdf-svg-lib · debian · bookworm; dsa · php-dompdf-svg-lib · debian · 12

    • 0.5.0-3+deb12u1 · all · bookworm

      Fixed · Fixed: 0.5.0-3+deb12u1

      dsa · php-dompdf-svg-lib · debian · bookworm; dsa · php-dompdf-svg-lib · debian · 12

    • 0.5.0-3+deb12u1 · all · bookworm-security

      Fixed · Fixed: 0.5.0-3+deb12u1

      dsa · php-dompdf-svg-lib · debian · bookworm; dsa · php-dompdf-svg-lib · debian · 12

    • 0.5.0-3+deb12u1 · all · bookworm-security

      Fixed · Fixed: 0.5.0-3+deb12u1

      dsa · php-dompdf-svg-lib · debian · bookworm; dsa · php-dompdf-svg-lib · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]