CVE-2024-25569

An out-of-bounds read vulnerability exists in the RAWCodec::DecodeBytes functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.

An out-of-bounds read vulnerability exists in the RAWCodec::DecodeBytes functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.

An out-of-bounds read vulnerability exists in the RAWCodec::DecodeBytes functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.

An out-of-bounds read vulnerability exists in the RAWCodec::DecodeBytes functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.

An out-of-bounds read vulnerability exists in the RAWCodec::DecodeBytes functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.

An out-of-bounds read vulnerability exists in the RAWCodec::DecodeBytes functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.

An out-of-bounds read vulnerability exists in the RAWCodec::DecodeBytes functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.

These are all security issues fixed in the orthanc-gdcm-1.7-1.1 package on the GA media of openSUSE Tumbleweed.

This update for orthanc, gdcm, orthanc-authorization, orthanc-dicomweb, orthanc-gdcm, orthanc-indexer, orthanc-mysql, orthanc-neuro, orthanc-postgresql, orthanc-python, orthanc-stl, orthanc-tcia, orthanc-wsi, python-pyorthanc fixes the following issues:

Changes in orthanc:

• dcmtk 370 breaks TW build

• switch to lua 5.4

• patch out boost component system from framework

• version 1.12.10 ' long changelog - see NEWS for details

• apply boost patch to source tree

• Stop trying to pull libboost_system-devel in all orthanc packages.

• remove libboost_system-devel for TW (removed in boost 1.89)

• version 1.12.9

  • long changelog - see NEWS for details

Changes in gdcm:

• apply fix for poppler 25.10 build error

Changes in orthanc-authorization:

• version 0.10.3

  • New default permissions for worklists
  • New default permissions for tools/metrics-prometheus
  • New default permissions for tools/generate-uid

• version 0.10.2

  • New default permissions to add/delete modalities through the Rest API https://discourse.orthanc-server.org/t/managing-modalities-using-the-rest-api-and-keycloak/6137
  • New standard configuration "stl"

• remove libboost_system-devel for TW (removed in boost 1.89)-

• version 0.10.1

  • Fix audit-logs export in CSV format.
  • New configuration "ExtraPermissions" to ADD new permissions to the default "Permissions" entries.
  • Improved handling of "Anonymous" user profiles (when no auth-tokens are provided): The plugin will now request the auth-service to get an anonymous user profile even if there are no auth-tokens in the HTTP request.
  • The User profile can now contain a "groups" field if the auth-service provides it.
  • The User profile can now contain an "id" field if the auth-service provides it.
  • New experimental feature: audit-logs
    • Enabled by the "EnableAuditLogs" configuration.
    • Audit-logs are currently handled by the PostgreSQL plugin and can be browsed through the route /auth/audit-logs.
    • New default permission "audit-logs" to grant access to the "/auth/audit-logs" route.
  • Fix: The "server-id" field is now included in all requests sent to the auth-service.

Changes in orthanc-dicomweb:

• version 1.22

  • framework2.diff added for compatibilty with Orthanc framework <= 1.12.10
  • Fixed a possible deadlock when using "WadoRsLoaderThreadsCount" > 1 when the HTTP client disconnects while downloading the response.
  • Fixed "Success: Success" errors when trying to send resources synchronously to a remote DICOMweb server while the Orthanc job engine was busy with other tasks.

• remove libboost_system-devel for TW (removed in boost 1.89)

• version 1.21

  • New configuration "WadoRsLoaderThreadsCount" to configure how many threads are loading files from the storage when answering to a WADO-RS query. A value > 1 is meaningful only if the storage is a distributed network storage (e.g object storage plugin). A value of 0 means reading and writing are performed in sequence (default behaviour).
  • New configuration "EnablePerformanceLogs" to display performance logs. Currently only showing the time required to execute a WADO-RS query. For example: WADO-RS: elapsed: 26106623 us, rate: 14.86 instances/s, 155.23Mbps
  • Fix false errors logs generated e.g when OHIF requests the /dicom-web/studies/../metadata route: "dicom-web:/Configuration.cpp:643] Unsupported return MIME type: application/dicom+json, multipart/related; type=application/octet-stream; transfer-syntax=*, will return DICOM+JSON"

Changes in orthanc-gdcm:

• version 1.8
  • Prevent transcoding of DICOM images with empty SharedFunctionalGroupsSequence (5200,9229), as this might crash GDCM.
  • The built-in Orthanc transcoder being usually more stable, the default value of the "RestrictTransferSyntaxes" configuration has been updated to configure the GDCM plugin for J2K transfer syntaxes only since these …