Search for packages
| purl | pkg:deb/debian/dcmtk@3.6.4-2.1 |
| Next non-vulnerable version | 3.7.0+really3.7.0-5 |
| Latest non-vulnerable version | 3.7.0+really3.7.0-5 |
| Risk | 3.4 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-3hrq-rt73-xyhe
Aliases: CVE-2025-9732 |
A vulnerability was identified in DCMTK up to 3.6.9. This affects an unknown function in the library dcmimage/include/dcmtk/dcmimage/diybrpxt.h of the component dcm2img. Such manipulation leads to memory corruption. Local access is required to approach this attack. The name of the patch is 7ad81d69b. It is best practice to apply a patch to resolve this issue. |
Affected by 7 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-3sc3-7e92-4bg9
Aliases: CVE-2024-52333 |
An improper array index validation vulnerability exists in the determineMinMax functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability. |
Affected by 7 other vulnerabilities. |
|
VCID-4cer-c7s9-muh3
Aliases: CVE-2022-43272 |
Affected by 7 other vulnerabilities. |
|
|
VCID-4me7-jacx-h3cn
Aliases: CVE-2025-2357 |
A vulnerability was found in DCMTK 3.6.9. It has been declared as critical. This vulnerability affects unknown code of the component dcmjpls JPEG-LS Decoder. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3239a7915. It is recommended to apply a patch to fix this issue. |
Affected by 7 other vulnerabilities. Affected by 5 other vulnerabilities. |
|
VCID-5a2e-vxc9-1uas
Aliases: CVE-2025-14841 |
A flaw has been found in OFFIS DCMTK up to 3.6.9. The impacted element is the function DcmQueryRetrieveIndexDatabaseHandle::startFindRequest/DcmQueryRetrieveIndexDatabaseHandle::startMoveRequest in the library dcmqrdb/libsrc/dcmqrdbi.cc of the component dcmqrscp. This manipulation causes null pointer dereference. The attack requires local access. Upgrading to version 3.7.0 is sufficient to resolve this issue. Patch name: ffb1a4a37d2c876e3feeb31df4930f2aed7fa030. You should upgrade the affected component. |
Affected by 7 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-6yvz-f6sg-9bcf
Aliases: CVE-2021-41689 |
DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null, which can incur a head-based overflow. An attacker can use it to launch a DoS attack. |
Affected by 7 other vulnerabilities. |
|
VCID-932k-yjb8-kqg9
Aliases: CVE-2025-25474 |
Affected by 7 other vulnerabilities. |
|
|
VCID-9aqw-3pdt-tfce
Aliases: CVE-2025-25472 |
Affected by 7 other vulnerabilities. |
|
|
VCID-9whc-wfjy-sbc8
Aliases: CVE-2021-41687 |
DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sending specific requests to the dcmqrdb program incur the memory leak. An attacker can use it to launch a DoS attack. |
Affected by 7 other vulnerabilities. |
|
VCID-db1n-477v-jbh6
Aliases: CVE-2024-47796 |
An improper array index validation vulnerability exists in the nowindow functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability. |
Affected by 7 other vulnerabilities. |
|
VCID-ff3t-fncn-wqgg
Aliases: CVE-2024-34508 |
dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. |
Affected by 7 other vulnerabilities. |
|
VCID-fw4j-hkw3-6uc1
Aliases: CVE-2024-34509 |
dcmdata in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. |
Affected by 7 other vulnerabilities. |
|
VCID-g3fh-up2y-qub7
Aliases: CVE-2021-41690 |
DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global variable LST and are not freed properly. Sending specific requests to the dcmqrdb program can incur a memory leak. An attacker can use it to launch a DoS attack. |
Affected by 7 other vulnerabilities. |
|
VCID-he83-y5qw-puf6
Aliases: CVE-2022-2121 |
OFFIS DCMTK's (All versions prior to 3.6.7) has a NULL pointer dereference vulnerability while processing DICOM files, which may result in a denial-of-service condition. |
Affected by 7 other vulnerabilities. |
|
VCID-j4ce-hbvu-afht
Aliases: CVE-2020-36855 |
A security vulnerability has been detected in DCMTK up to 3.6.5. The affected element is the function parseQuota of the component dcmqrscp. The manipulation of the argument StorageQuota leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Upgrading to version 3.6.6 is sufficient to fix this issue. The identifier of the patch is 0fef9f02e. It is recommended to upgrade the affected component. |
Affected by 7 other vulnerabilities. |
|
VCID-kj3f-v79k-sqdz
Aliases: CVE-2021-41688 |
DCMTK through 3.6.6 does not handle memory free properly. The object in the program is free but its address is still used in other locations. Sending specific requests to the dcmqrdb program will incur a double free. An attacker can use it to launch a DoS attack. |
Affected by 7 other vulnerabilities. |
|
VCID-nns6-y3qv-5bbg
Aliases: CVE-2025-25475 |
Affected by 7 other vulnerabilities. |
|
|
VCID-nujk-xrzu-7qbd
Aliases: CVE-2025-14607 |
A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 can resolve this issue. The patch is identified as 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. You should upgrade the affected component. |
Affected by 7 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-r2m6-vfud-x3eb
Aliases: CVE-2022-2120 |
OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution. |
Affected by 7 other vulnerabilities. |
|
VCID-sv4a-ndgr-wbbc
Aliases: CVE-2022-2119 |
OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution. |
Affected by 7 other vulnerabilities. |
|
VCID-wzbj-7mz3-cfc1
Aliases: CVE-2022-4981 |
A vulnerability was detected in DCMTK up to 3.6.7. The impacted element is the function DcmQueryRetrieveConfig::readPeerList of the file /dcmqrcnf.cc of the component dcmqrscp. The manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit is now public and may be used. Upgrading to version 3.6.8 is sufficient to resolve this issue. The patch is identified as 957fb31e5. Upgrading the affected component is advised. |
Affected by 7 other vulnerabilities. Affected by 5 other vulnerabilities. |
|
VCID-z7du-3v7e-2kab
Aliases: CVE-2024-28130 |
Affected by 7 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-3rhb-exsv-gybw | OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress() (file dcrledec.h, line 122). The attack vector is: Many scenarios of DICOM file processing (e.g. DICOM to image conversion). The fixed version is: 3.6.4, after commit 40917614e. |
CVE-2019-1010228
|