Dompdf 0.6.2

[BrianS]

The Dompdf team is happy to announce the availability of Dompdf 0.6.2. This is a security-focused release that addresses a number of vulnerabilities that can expose your system to exploitation. In tandem with this release we have also posted a document to the wiki with advice for securing dompdf. Please read the new document and take appropriate measures to protect your systems.

We urge all users to upgrade to this release if you are using dompdf 0.6.1 or earlier.

Change Summary for 0.6.2

This update addresses the following announced vulnerabilities:

• Remote Code Execution
  
• Denial of Service Vector
  
• Information Disclosure
  
• Arbitrary file read in dompdf using PHP stream filters
• PHP remote file inclusion vulnerability in dompdf.php

Change Summary for 0.6.1

• Removed pre-processing of PHP code when DOMPDF_ENABLE_PHP is true (this does not affect embedded script).
• Prior to this release dompdf was vulnerable to an information disclosure vulnerability. Thanks to [Portcullis Computer Security Ltd.](http://www.portcullis-security.com) for reporting the issue. See the security advisory for additional details: [Arbitrary file read in dompdf](https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383/).
  

Change Summary for 0.6.0

• Fonts: Full Unicode support (with embedded fonts); DejaVu fonts pre-installed; php-font-lib now provides font handling and sub-setting
• CSS: float support, border radius, transparency, `@page`, `@font-face`, generated content, fixed-positioning, transformations
• HTML: HTML5 Parser cleans your HTML syntax
• Images: Expanded image handling (including alpha transparency); added support for Data-URI image sources
• Performance improvements
• The project is now hosted on GitHub (the Google Code project is being temporarily maintained).
  

You can find the full release notes and packaged download at https://github.com/dompdf/dompdf/releases/tag/v0.6.2

Please post any questions, comments, or suggestions to this group. Issues can be posted to the issue tracker.