An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and     CURLOPT_SSL_VERIFYPEER are set unsafely. (CVE-2024-56521)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c17ef0f176 advisory.

    **phpMyAdmin 5.2.2 is released**

    Welcome to the release of phpMyAdmin version 5.2.2, the I should have released this sooner release. This     is primarily a bugfix release but also contains a few security fixes as noted below.

    *    fix possible security issue in sql-parser which could cause long execution times that could create a     DOS attack (thanks to Maximilian Krg)
    *    fix an XSS vulnerability in the check tables feature (**PMASA-2025-1**, thanks to bluebird)
    *    fix an XSS vulnerability in the Insert tab (**PMASA-2025-2**, thanks to frequent contributor Kamil     Tekiela)
    *    fix possible security issue with library code slim/psr7 (**CVE-2023-30536**)
    *    fix possible security issue relating to iconv (**CVE-2024-2961, PMASA-2025-3**)
    *    fix a full path disclosure in the Monitoring tab
    *    issue #18268 Fix UI issue the theme manager is disabled
    *    issue Allow opening server breadcrumb links in new tab with Ctrl/Meta key
    *    issue #19141 Add cookie prefix '-__Secure-' to cookies to help prevent cookie smuggling
    *    issue #18106 Fix renaming database with a view
    *    issue #18120 Fix bug with numerical tables during renaming database
    *    issue #16851 Fix ($cfg['Order']) default column order doesn't have have any effect since phpMyAdmin     4.2.0
    *    issue #18258 Speed improvements when exporting a database
    *    issue #18769 Improved collations support for MariaDB 10.10

    There are many, many more fixes that you can see in the ChangeLog file included with this release or     [online](https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_2/ChangeLog)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-4b8ab3834c advisory.

    **phpMyAdmin 5.2.2 is released**

    Welcome to the release of phpMyAdmin version 5.2.2, the I should have released this sooner release. This     is primarily a bugfix release but also contains a few security fixes as noted below.

    *    fix possible security issue in sql-parser which could cause long execution times that could create a     DOS attack (thanks to Maximilian Krg)
    *    fix an XSS vulnerability in the check tables feature (**PMASA-2025-1**, thanks to bluebird)
    *    fix an XSS vulnerability in the Insert tab (**PMASA-2025-2**, thanks to frequent contributor Kamil     Tekiela)
    *    fix possible security issue with library code slim/psr7 (**CVE-2023-30536**)
    *    fix possible security issue relating to iconv (**CVE-2024-2961, PMASA-2025-3**)
    *    fix a full path disclosure in the Monitoring tab
    *    issue #18268 Fix UI issue the theme manager is disabled
    *    issue Allow opening server breadcrumb links in new tab with Ctrl/Meta key
    *    issue #19141 Add cookie prefix '-__Secure-' to cookies to help prevent cookie smuggling
    *    issue #18106 Fix renaming database with a view
    *    issue #18120 Fix bug with numerical tables during renaming database
    *    issue #16851 Fix ($cfg['Order']) default column order doesn't have have any effect since phpMyAdmin     4.2.0
    *    issue #18258 Speed improvements when exporting a database
    *    issue #18769 Improved collations support for MariaDB 10.10

    There are many, many more fixes that you can see in the ChangeLog file included with this release or     [online](https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_2/ChangeLog)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and
    CURLOPT_SSL_VERIFYPEER are set unsafely. (CVE-2024-56521)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-d6b0e72e3d advisory.

    **Version 6.8.0** (2024-12-23)

    - Requires PHP 7.1+ and curl extension.
    - Escape error message.
    - Use strict time-constant function to compare TCPDF-tag hashes.
    - Add K_CURLOPTS config array to set custom cURL options (NOTE: some defaults have changed).
    - Add some addTTFfont fixes from tc-lib-pdf-font.




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-7d6412477b advisory.

    **Version 6.8.0** (2024-12-23)

    - Requires PHP 7.1+ and curl extension.
    - Escape error message.
    - Use strict time-constant function to compare TCPDF-tag hashes.
    - Add K_CURLOPTS config array to set custom cURL options (NOTE: some defaults have changed).
    - Add some addTTFfont fixes from tc-lib-pdf-font.




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
231271	Linux Distros Unpatched Vulnerability : CVE-2024-56521	Nessus	Misc.	critical
214840	Fedora 40 : phpMyAdmin (2025-c17ef0f176)	Nessus	Fedora Local Security Checks	medium
214839	Fedora 41 : phpMyAdmin (2025-4b8ab3834c)	Nessus	Fedora Local Security Checks	medium
413368	SCA: security update for tecnickcom/tcpdf (GHSA-9mgx-552f-59p6)	Tenable Cloud Security	SCA Checks	high
413368	SCA: security update for tecnickcom/tcpdf (GHSA-9mgx-552f-59p6)	Tenable Self-Hosted Container Security	SCA Checks	high
213552	Fedora 40 : php-tcpdf (2024-d6b0e72e3d)	Nessus	Fedora Local Security Checks	critical
213551	Fedora 41 : php-tcpdf (2024-7d6412477b)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2024-56521

high

Tenable Plugins

critical

medium

medium

high

high

critical

critical