CVE-2024-34508

dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message.

Multiple vulnerabilities have been fixed in DCMTK, a collection of libraries and applications implementing large parts the DICOM standard for medical images. CVE-2024-28130 Segmentation faults due to incorrect typecast CVE-2024-34508 Segmentation fault via invalid DIMSE message CVE-2024-34509 Segmentation fault via invalid DIMSE message

This update for dcmtk fixes the following issues:

Update to 3.6.9. See DOCS/CHANGES.368 for the full list of changes

Security issues fixed:

• CVE-2024-27628: Fixed buffer overflow via the EctEnhancedCT method (boo#1227235)
• CVE-2024-34508: Fixed a segmentation fault via an invalid DIMSE message (boo#1223925)
• CVE-2024-34509: Fixed segmentation fault via an invalid DIMSE message (boo#1223943)
• CVE-2024-47796: Fixed out-of-bounds write due to improper array index validation in the nowindow functionality (boo#1235810)
• CVE-2024-52333: Fixed out-of-bounds write due to improper array index validation in the determineMinMax functionality (boo#1235811)

Jinsheng Ba discovered that DCMTK incorrectly handled certain requests. If a user or an automated system were tricked into opening a certain specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-41687, CVE-2021-41688, CVE-2021-41689, CVE-2021-41690)

Sharon Brizinov and Noam Moshe discovered that DCMTK incorrectly handled pointers. If a user or an automated system were tricked into opening a certain specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2022-2121)

It was discovered that DCMTK incorrectly handled certain inputs. If a user or an automated system were tricked into opening a certain specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2022-43272)

It was discovered that DCMTK incorrectly handled certain inputs. If a user or an automated system were tricked into opening a certain specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. This issue was only addressed in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-28130)

It was discovered that DCMTK incorrectly handled memory when processing an invalid incoming DIMSE message. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-34508, CVE-2024-34509)