Advisories for Composer/Tecnickcom/Tcpdf package

TCPDF version <=6.7.4 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.

TCPDF before 6.7.4 mishandles calls that use HTML syntax.

Attackers can trigger deserialization of arbitrary data via the phar:// wrapper.