CVE-2024-34508 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	4.3 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CISA-ADP	ADP	4.3 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 17%

Affected Products (NVD)

Vendor	Product	Version
offis	dcmtk	𝑥 < 3.6.9
debian	debian_linux	10.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

dcmtk

bookworm	3.6.7-9~deb12u3 fixed
bullseye	vulnerable
bullseye (security)	3.6.5-1+deb11u5 fixed
forky	3.6.9-6 fixed
sid	3.6.9-6 fixed
trixie	3.6.9-5 fixed

Ubuntu Releases

Ubuntu Product

Codename

dcmtk

bionic	Fixed 3.6.2-3ubuntu0.1~esm2 released
focal	Fixed 3.6.4-2.1ubuntu0.1 released
jammy	Fixed 3.6.6-5ubuntu0.1~esm2 released
mantic	ignored
noble	Fixed 3.6.7-9.1ubuntu0.1~esm1 released
oracular	ignored
plucky	needs-triage
questing	needs-triage
xenial	Fixed 3.6.1~20150924-5ubuntu0.1~esm2 released

Known Exploits!

Common Weakness Enumeration

CWE-476 - NULL Pointer Dereference
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

References

https://github.com/DCMTK/dcmtk/commit/c78e434c0c5f9d932874f0b17a8b4ce305ca01f5

https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html

https://support.dcmtk.org/redmine/issues/1114

https://github.com/DCMTK/dcmtk/commit/c78e434c0c5f9d932874f0b17a8b4ce305ca01f5

https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html

https://lists.debian.org/debian-lts-announce/2025/01/msg00032.html

https://support.dcmtk.org/redmine/issues/1114