PT-2024-36829 · Unknown+3 · Tc-Lib-Pdf-Font+3

Published 2024-12-27 · Updated 2025-08-21 · CVE-2024-56520

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions tc-lib-pdf-font versions prior to 2.6.4 TCPDF versions prior to 6.8.0

Description The issue is related to the mishandling of fonts, specifically the misparsing of FontBBox for Type 1 and TrueType fonts. This problem affects the management of fonts in the affected software.

Recommendations For tc-lib-pdf-font versions prior to 2.6.4, update to version 2.6.4 or later to resolve the issue. For TCPDF versions prior to 6.8.0, update to version 6.8.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of Type 1 and TrueType fonts in the affected software until a patch is available.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-10829

CVE-2024-56520

DLA-4199-1

DSA-5933-1

GHSA-GRHH-R4JJ-8JH7

Affected Products

Debian

Red Os

Tcpdf

Tc-Lib-Pdf-Font

References · 24

• https://osv.dev/vulnerability/DLA-4199-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5933-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-56520 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10829 · Security Note
• https://ubuntu.com/security/CVE-2024-56520 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-56520 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56520 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-56520 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-grhh-r4jj-8jh7 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-56520 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-56520 · Vendor Advisory
• https://github.com/tecnickcom/TCPDF/compare/6.7.8...6.8.0 · Note
• https://github.com/tecnickcom/TCPDF/commit/a0a02efe487cc39bd5223359e916dbeafb5cd6fe · Note
• https://github.com/tecnickcom/tc-lib-pdf-font/compare/2.6.2...2.6.4 · Note