CVE-2013-6825
(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc...
(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprscp.cc and (6) dcmpsrcv.cc in dcmpstat/apps/, (7) dcmpstat/tests/msgserv.cc, and (8) dcmqrdb/apps/dcmqrscp.cc in DCMTK 3.6.1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by creating a large number of processes.
Exploit likelihood
What each source reports
NVD Score used
(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprscp.cc and (6) dcmpsrcv.cc in dcmpstat/apps/, (7) dcmpstat/tests/msgserv.cc, and (8) dcmqrdb/apps/dcmqrscp.cc in DCMTK 3.6.1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by creating a large number of processes.
- Record
CVE-2013-6825- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprscp.cc and (6) dcmpsrcv.cc in dcmpstat/apps/, (7) dcmpstat/tests/msgserv.cc, and (8) dcmqrdb/apps/dcmqrscp.cc in DCMTK 3.6.1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by creating a large number of processes.
- Record
CVE-2013-6825- Updated
- 2026-11-02
EUVDEUVD-2013-6627 No score
(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprscp.cc and (6) dcmpsrcv.cc in dcmpstat/apps/, (7) dcmpstat/tests/msgserv.cc, and (8) dcmqrdb/apps/dcmqrscp.cc in DCMTK 3.6.1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by creating a large number of processes.
- Record
EUVD-2013-6627- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9xf4-22r3-7ccc No score
(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc...
(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprscp.cc and (6) dcmpsrcv.cc in dcmpstat/apps/, (7) dcmpstat/tests/msgserv.cc, and (8) dcmqrdb/apps/dcmqrscp.cc in DCMTK 3.6.1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by creating a large number of processes.
- Record
GHSA-9xf4-22r3-7ccc- Updated
- 2026-11-02
OSV No score
(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprscp.cc and (6) dcmpsrcv.cc in dcmpstat/apps/, (7) dcmpstat/tests/msgserv.cc, and (8) dcmqrdb/apps/dcmqrscp.cc in DCMTK 3.6.1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by creating a large number of processes.
- Record
CVE-2013-6825- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-6825 No score
(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprscp.cc and (6) dcmpsrcv.cc in dcmpstat/apps/, (7) dcmpstat/tests/msgserv.cc, and (8) dcmqrdb/apps/dcmqrscp.cc in DCMTK 3.6.1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by creating a large number of processes.
- Record
DEBIAN-CVE-2013-6825- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-6825 No score
(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprscp.cc and (6) dcmpsrcv.cc in dcmpstat/apps/, (7) dcmpstat/tests/msgserv.cc, and (8) dcmqrdb/apps/dcmqrscp.cc in DCMTK 3.6.1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by creating a large number of processes.
- Record
UBUNTU-CVE-2013-6825- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dcmtkDebian:12 |
before 3.6.1~20150629-1 | 3.6.1~20150629-1 |
dcmtkDebian:13 |
before 3.6.1~20150629-1 | 3.6.1~20150629-1 |
dcmtkDebian:14 |
before 3.6.1~20150629-1 | 3.6.1~20150629-1 |
dcmtkUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 3.6.7-93.6.7-9.1build23.6.7-9.1build33.6.7-9.1build43.6.7-9.1ubuntu0.1~esm1 |
None known |
dcmtkUbuntu:25.10 |
All versions, plus listed versions 3.6.9-43.6.9-53.6.9-5build1 |
None known |
dcmtkUbuntu:26.10 |
All versions, plus listed versions 3.7.0+really3.6.9-13.7.0+really3.7.0-23.7.0+really3.7.0-53.7.0+really3.7.0-63.7.0+really3.7.0-7ubuntu1 |
None known |
dcmtkUbuntu:26.04:LTS |
All versions, plus listed versions 3.6.9-5build13.6.9-63.7.0+really3.6.9-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-6825 is a high vulnerability (CVSS 7.2) in Offis Dcmtk, published June 10, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in dcmtk 3.6.1~20150629-1.
References
securityfocus.com/archive/1/532261/100/0/threaded
packetstormsecurity.com/files/126883/DCMTK-Privilege-Escalation.html
secunia.com/advisories/58916
git.dcmtk.org/web?p=dcmtk.git%3Ba=blob%3Bf=CHANGES.361
seclists.org/fulldisclosure/2014/Jun/11