Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-94108 →
DEBIAN-CVE-2026-94108
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity l...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
php-getid3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
php-getid3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
php-getid3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.27+dfsg-1"}]}]
Références
- advisory security-tracker.debian.org