CVE-2019-1010228

EUVD-2019-1970
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress() (file dcrledec.h, line 122). The attack vector is: Many scenarios of DICOM file processing (e.g. DICOM to image conversion). The fixed version is: 3.6.4, after commit 40917614e.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 69%
Affected Products (NVD)
VendorProductVersion
offisdcmtk
𝑥
≤ 3.6.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
dcmtk
bookworm
3.6.7-9~deb12u1
fixed
bullseye
3.6.5-1
fixed
jessie
no-dsa
sid
3.6.8-6
fixed
stretch
no-dsa
trixie
3.6.8-6
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
dcmtk
bionic
Fixed 3.6.2-3ubuntu0.1~esm1
released
disco
not-affected
eoan
not-affected
focal
not-affected
groovy
not-affected
hirsute
not-affected
impish
not-affected
jammy
not-affected
kinetic
not-affected
lunar
not-affected
trusty
dne
xenial
Fixed 3.6.1~20150924-5ubuntu0.1~esm1
released
Common Weakness Enumeration
References
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQOAULR72EYJQ4HS6YGLK2S6YNEXY2ET/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBKP2O24CTYIANEJTP4TVEPYEVSYV2RX/
https://support.dcmtk.org/redmine/issues/858
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQOAULR72EYJQ4HS6YGLK2S6YNEXY2ET/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBKP2O24CTYIANEJTP4TVEPYEVSYV2RX/
https://support.dcmtk.org/redmine/issues/858