Veracode Vulnerability DatabaseVERACODE:45600Arbitrary Code Execution
6.8 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
7.5 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.8%
phenx/php-svg-lib is vulnerable to Arbitrary Code Execution. The vulnerability due to lack of validation of the font-family attribute. An attacker can parse a Scalable Vector Graphics (SVG) containing a PHAR url within the the font family attribute, potentially leading to arbitrary code execution.
| CPE | Name | Operator | Version |
|---|---|---|---|
| phenx/php-svg-lib | le | 0.5.1 | |
| phenx/php-svg-lib | le | 0.5.1 |
Related
6.8 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
7.5 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.8%