{"id":"UBUNTU-CVE-2022-2400","details":"External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.","modified":"2026-05-20T16:07:45.031111077Z","published":"2022-07-18T15:15:00Z","related":["USN-6277-1","USN-6277-2"],"upstream":["CVE-2022-2400"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-2400"},{"type":"REPORT","url":"https://huntr.dev/bounties/a6da5e5e-86be-499a-a3c3-2950f749202a"},{"type":"REPORT","url":"https://github.com/dompdf/dompdf/commit/99aeec1efec9213e87098d42eb09439e7ee0bb6a"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-6277-1"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-6277-2"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2022-2400"}],"affected":[{"package":{"name":"php-dompdf","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/php-dompdf?arch=source&distro=esm-apps%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1+dfsg-2ubuntu1+esm1"}]}],"versions":["0.6.1+dfsg-2","0.6.1+dfsg-2build1","0.6.1+dfsg-2ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"php-dompdf","binary_version":"0.6.1+dfsg-2ubuntu1+esm1"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2400.json"}},{"package":{"name":"civicrm","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/civicrm?arch=source&distro=esm-apps%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7.1+dfsg-1","4.7.1+dfsg-2","4.7.1+dfsg-2ubuntu1","4.7.1+dfsg-2ubuntu1+esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"civicrm-common","binary_version":"4.7.1+dfsg-2ubuntu1+esm1"},{"binary_name":"civicrm-l10n","binary_version":"4.7.1+dfsg-2ubuntu1+esm1"},{"binary_name":"drupal7-mod-civicrm","binary_version":"4.7.1+dfsg-2ubuntu1+esm1"},{"binary_name":"wordpress-civicrm","binary_version":"4.7.1+dfsg-2ubuntu1+esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2400.json"}},{"package":{"name":"icingaweb2","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/icingaweb2?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0-1ubuntu1","2.1.0-1ubuntu1.1","2.1.0-1ubuntu1.2"],"ecosystem_specific":{"binaries":[{"binary_name":"icingaweb2","binary_version":"2.1.0-1ubuntu1.2"},{"binary_version":"2.1.0-1ubuntu1.2","binary_name":"icingaweb2-module-monitoring"},{"binary_name":"php-icinga","binary_version":"2.1.0-1ubuntu1.2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2400.json"}},{"package":{"name":"civicrm","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/civicrm?arch=source&distro=esm-apps%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7.23+dfsg-1ubuntu1","4.7.24+dfsg-1ubuntu1","4.7.30+dfsg-1ubuntu1","4.7.30+dfsg-1ubuntu1+esm1"],"ecosystem_specific":{"binaries":[{"binary_version":"4.7.30+dfsg-1ubuntu1+esm1","binary_name":"civicrm-common"},{"binary_name":"civicrm-l10n","binary_version":"4.7.30+dfsg-1ubuntu1+esm1"},{"binary_name":"wordpress-civicrm","binary_version":"4.7.30+dfsg-1ubuntu1+esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2400.json"}},{"package":{"name":"icingaweb2","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/icingaweb2?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1-1","2.4.1-1ubuntu0.1"],"ecosystem_specific":{"binaries":[{"binary_name":"icingacli","binary_version":"2.4.1-1ubuntu0.1"},{"binary_version":"2.4.1-1ubuntu0.1","binary_name":"icingaweb2"},{"binary_name":"icingaweb2-common","binary_version":"2.4.1-1ubuntu0.1"},{"binary_name":"icingaweb2-module-monitoring","binary_version":"2.4.1-1ubuntu0.1"},{"binary_name":"php-icinga","binary_version":"2.4.1-1ubuntu0.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2400.json"}},{"package":{"name":"php-dompdf","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/php-dompdf?arch=source&distro=esm-apps%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.2+dfsg-3ubuntu0.18.04.1~esm1"}]}],"versions":["0.6.2+dfsg-3"],"ecosystem_specific":{"binaries":[{"binary_name":"php-dompdf","binary_version":"0.6.2+dfsg-3ubuntu0.18.04.1~esm1"}],"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2400.json"}},{"package":{"name":"php-dompdf","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/php-dompdf?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.2+dfsg-3ubuntu0.20.04.1"}]}],"versions":["0.6.2+dfsg-3"],"ecosystem_specific":{"binaries":[{"binary_name":"php-dompdf","binary_version":"0.6.2+dfsg-3ubuntu0.20.04.1"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2400.json"}},{"package":{"name":"civicrm","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/civicrm?arch=source&distro=esm-apps%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0+dfsg-1","5.18.1+dfsg-1","5.20.3+dfsg-1","5.21.0+dfsg-1","5.21.1+dfsg-1","5.21.2+dfsg-1","5.21.2+dfsg-1ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"civicrm-common","binary_version":"5.21.2+dfsg-1ubuntu0.1~esm1"},{"binary_name":"civicrm-l10n","binary_version":"5.21.2+dfsg-1ubuntu0.1~esm1"},{"binary_name":"wordpress-civicrm","binary_version":"5.21.2+dfsg-1ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2400.json"}},{"package":{"name":"icingaweb2","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/icingaweb2?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.1-1","2.7.3-1"],"ecosystem_specific":{"binaries":[{"binary_version":"2.7.3-1","binary_name":"icingacli"},{"binary_name":"icingaweb2","binary_version":"2.7.3-1"},{"binary_version":"2.7.3-1","binary_name":"icingaweb2-common"},{"binary_version":"2.7.3-1","binary_name":"icingaweb2-module-monitoring"},{"binary_name":"php-icinga","binary_version":"2.7.3-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2400.json"}},{"package":{"name":"icingaweb2","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/icingaweb2?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.2-2","2.9.3-1","2.9.4-1","2.9.5-1"],"ecosystem_specific":{"binaries":[{"binary_version":"2.9.5-1","binary_name":"icingacli"},{"binary_version":"2.9.5-1","binary_name":"icingaweb2"},{"binary_version":"2.9.5-1","binary_name":"icingaweb2-common"},{"binary_name":"icingaweb2-module-monitoring","binary_version":"2.9.5-1"},{"binary_version":"2.9.5-1","binary_name":"php-icinga"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2400.json"}},{"package":{"name":"php-dompdf","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/php-dompdf?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.2+dfsg-3.1ubuntu0.1"}]}],"versions":["0.6.2+dfsg-3.1"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"php-dompdf","binary_version":"0.6.2+dfsg-3.1ubuntu0.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2400.json"}},{"package":{"name":"civicrm","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/civicrm?arch=source&distro=esm-apps%2Fjammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.33.2+dfsg1-1","5.33.2+dfsg1-1build1","5.33.2+dfsg1-1ubuntu1","5.33.2+dfsg1-1ubuntu1+esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"civicrm-common","binary_version":"5.33.2+dfsg1-1ubuntu1+esm1"},{"binary_name":"civicrm-l10n","binary_version":"5.33.2+dfsg1-1ubuntu1+esm1"},{"binary_name":"wordpress-civicrm","binary_version":"5.33.2+dfsg1-1ubuntu1+esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2400.json"}},{"package":{"name":"icingaweb2","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/icingaweb2?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.11.4-3","2.12.0-1","2.12.1-1"],"ecosystem_specific":{"binaries":[{"binary_name":"icingacli","binary_version":"2.12.1-1"},{"binary_version":"2.12.1-1","binary_name":"icingaweb2"},{"binary_version":"2.12.1-1","binary_name":"icingaweb2-common"},{"binary_name":"icingaweb2-module-monitoring","binary_version":"2.12.1-1"},{"binary_name":"php-icinga","binary_version":"2.12.1-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2400.json"}},{"package":{"name":"icingaweb2","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/icingaweb2?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.2-1","2.12.4-1","2.12.4-2"],"ecosystem_specific":{"binaries":[{"binary_name":"icingacli","binary_version":"2.12.4-2"},{"binary_name":"icingaweb2","binary_version":"2.12.4-2"},{"binary_version":"2.12.4-2","binary_name":"icingaweb2-common"},{"binary_version":"2.12.4-2","binary_name":"icingaweb2-module-monitoring"},{"binary_name":"php-icinga","binary_version":"2.12.4-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2400.json"}},{"package":{"name":"icingaweb2","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/icingaweb2?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.4-2","2.12.5-1","2.12.6-1"],"ecosystem_specific":{"binaries":[{"binary_version":"2.12.6-1","binary_name":"icingacli"},{"binary_name":"icingaweb2","binary_version":"2.12.6-1"},{"binary_name":"icingaweb2-common","binary_version":"2.12.6-1"},{"binary_name":"icingaweb2-module-monitoring","binary_version":"2.12.6-1"},{"binary_version":"2.12.6-1","binary_name":"php-icinga"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-2400.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"medium"}]}