{"id":"CVE-2022-2120","aliases":["DEBIAN-CVE-2022-2120","DLA-4227-1","EUVD-2022-34406","GHSA-9hc9-vchg-8p47","MGASA-2023-0083","UBUNTU-CVE-2022-2120","USN-5882-1","openSUSE-SU-2022:10144-1","openSUSE-SU-2022:10145-1","openSUSE-SU-2023:0108-1"],"status":"published","title":"OFFIS DCMTK Path Traversal","description":"OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.03368,"percentile":0.88832,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-23"],"published":"2022-06-24T15:00:18Z","modified":"2026-11-03T08:02:10Z","fixes":[{"ecosystem":"Debian:12","package":"dcmtk","fixed_in":["3.6.7-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dcmtk","fixed_in":["3.6.7-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dcmtk","fixed_in":["3.6.7-6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dcmtk","fixed_in":["3.6.1~20150924-5ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dcmtk","fixed_in":["3.6.2-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dcmtk","fixed_in":["3.6.4-2.1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"dcmtk","fixed_in":["3.6.6-5ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"dcmtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dcmtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dcmtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-6"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"dcmtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-1+deb11u4"}]}],"versions":["3.6.5-1","3.6.5-1+deb11u1","3.6.5-1+deb11u2","3.6.5-1+deb11u3"],"bundled":7},{"source":"osv","ecosystem":"Mageia:8","package":"dcmtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-3.1.mga8"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dcmtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1~20150924-5ubuntu0.1~esm1"}]}],"versions":["3.6.0-15.1","3.6.1~20150629-5","3.6.1~20150924-4","3.6.1~20150924-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dcmtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-3ubuntu0.1~esm1"}]}],"versions":["3.6.2-2","3.6.2-2build1","3.6.2-3","3.6.2-3build1","3.6.2-3build2","3.6.2-3build3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dcmtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.4-2.1ubuntu0.1~esm1"}]}],"versions":["3.6.4-2.1","3.6.4-2.1build1","3.6.4-2.1build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"dcmtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-5ubuntu0.1~esm1"}]}],"versions":["3.6.5-1","3.6.6-3ubuntu1","3.6.6-3ubuntu2","3.6.6-4","3.6.6-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"dcmtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.7-9","3.6.7-9.1build2","3.6.7-9.1build3","3.6.7-9.1build4","3.6.7-9.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dcmtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.9-4","3.6.9-5","3.6.9-5build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"dcmtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.0+really3.6.9-1","3.7.0+really3.7.0-2","3.7.0+really3.7.0-5","3.7.0+really3.7.0-6","3.7.0+really3.7.0-7ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dcmtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.9-5build1","3.6.9-6","3.7.0+really3.6.9-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dcmtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1~20150924-5ubuntu0.1~esm1"}]}],"versions":["3.6.0-15.1","3.6.1~20150629-5","3.6.1~20150924-4","3.6.1~20150924-5"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dcmtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-3ubuntu0.1~esm1"}]}],"versions":["3.6.2-2","3.6.2-2build1","3.6.2-3","3.6.2-3build1","3.6.2-3build2","3.6.2-3build3"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dcmtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.4-2.1ubuntu0.1~esm1"}]}],"versions":["3.6.4-2.1","3.6.4-2.1build1","3.6.4-2.1build2"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"dcmtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-5ubuntu0.1~esm1"}]}],"versions":["3.6.5-1","3.6.6-3ubuntu1","3.6.6-3ubuntu2","3.6.6-4","3.6.6-5"],"bundled":10},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-bp153.2.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"orthanc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.2-bp153.2.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"orthanc-gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-bp153.2.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"orthanc-webviewer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-bp153.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-bp153.2.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"orthanc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.2-bp153.2.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"orthanc-gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-bp153.2.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"orthanc-webviewer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-bp153.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-bp154.2.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"orthanc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.2-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"orthanc-gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"orthanc-webviewer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-bp154.2.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"orthanc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.2-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"orthanc-gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"orthanc-webviewer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"dcmtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-bp154.2.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"dcmtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-bp154.2.3.1"}]}],"bundled":4}],"products":[{"vendor":"offis","product":"dcmtk"}],"references":[{"url":"https://www.cisa.gov/uscert/ics/advisories/icsma-22-174-01","tags":["x_refsource_MISC","x_transferred","Mitigation","Third Party Advisory","US Government Resource","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/06/msg00025.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2120","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9hc9-vchg-8p47"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2120.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-2120","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0083.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30790","tags":["report"]},{"url":"https://dicom.offis.de/download/dcmtk/dcmtk367/ANNOUNCE","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2Z7WVDK43MKWOS23BIN4VCQRQRXHGSDB/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/WF2FCZOYXVZ4ETCHO62JWUP4D55UWJCV/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5882-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-2120","tags":["report"]},{"url":"https://support.dcmtk.org/redmine/issues/1021","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2120","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8979","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-1010228","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-41687","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-41688","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-41689","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-41690","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-2119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-2121","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-43272","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/K67WDY4JVASQKGAJHGMCE45SJSPPFKPM/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1181400","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2120","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OTK3TBM5PVZQBCMNB7R6KN74EKSALYHH/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MKL5XGJX4U2PD4XAVAZG2YAU2LYKLQIH/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1206070","tags":["report"]},{"url":"https://bugzilla.suse.com/1208637","tags":["report"]},{"url":"https://bugzilla.suse.com/1208638","tags":["report"]},{"url":"https://bugzilla.suse.com/1208639","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-43272","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-2120","title":"OFFIS DCMTK Path Traversal","description":"OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.","status":"published","published":"2022-06-24T15:00:18.707Z","modified":"2025-11-03T19:26:45.345Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:34:32.156873Z"}],"euvd":[{"id":"EUVD-2022-34406","description":"OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.","status":"published","published":"2022-06-24T15:00:18Z","modified":"2025-11-03T19:26:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:34.152725Z"}],"ghsa":[{"id":"GHSA-9hc9-vchg-8p47","title":"OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative...","description":"OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.","status":"published","published":"2022-06-25T00:00:54Z","modified":"2025-11-03T21:30:42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22","CWE-23"],"updated_at":"2026-11-02T15:04:18.176646Z"}],"nvd":[{"id":"CVE-2022-2120","description":"OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.","status":"published","published":"2022-06-24T15:15:10.743Z","modified":"2026-06-17T04:41:20.557Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-23","CWE-22"],"updated_at":"2026-11-02T14:07:22.613788Z"}],"osv":[{"id":"CVE-2022-2120","title":"OFFIS DCMTK Path Traversal","description":"OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.","status":"published","published":"2022-06-24T15:00:18.707Z","modified":"2026-10-28T02:30:30.79033343Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T15:44:23.655778Z"},{"id":"DEBIAN-CVE-2022-2120","description":"OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.","status":"published","published":"2022-06-24T15:15:10.743Z","modified":"2026-11-03T08:02:10.539226649Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"UBUNTU-CVE-2022-2120","description":"OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.","status":"published","published":"2022-06-24T15:15:00Z","modified":"2026-10-17T12:56:16.873265857Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:52.391598Z"},{"id":"DLA-4227-1","title":"dcmtk - security update","status":"published","published":"2025-06-24T00:00:00Z","modified":"2026-03-09T01:20:45.633107Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2023-0083","title":"Updated dcmtk packages fix security vulnerability","description":"Jinsheng Ba discovered that DCMTK incorrectly handled certain requests. If\na user or an automated system were tricked into opening a certain\nspecially crafted input file, a remote attacker could possibly use this\nissue to cause a denial of service. (CVE-2021-41687, CVE-2021-41688,\nCVE-2021-41689, and CVE-2021-41690)\n\nSharon Brizinov and Noam Moshe discovered that DCMTK incorrectly handled\ncertain inputs. If a user or an automated system were tricked into opening\na certain specially crafted input file, a remote attacker could possibly\nuse this issue to execute arbitrary code. (CVE-2022-2119 and\nCVE-2022-2120)\n\nSharon Brizinov and Noam Moshe discovered that DCMTK incorrectly handled\npointers. If a user or an automated system were tricked into opening a\ncertain specially crafted input file, a remote attacker could possibly use\nthis issue to cause a denial of service. (CVE-2022-2121)\n\nIt was discovered that DCMTK incorrectly handled certain inputs. If a\nuser or an automated system were tricked into opening a certain specially\ncrafted input file, a remote attacker could possibly use this issue to\ncause a denial of service. (CVE-2022-43272)\n","status":"published","published":"2023-03-11T19:00:39Z","modified":"2026-04-16T04:41:21.850253307Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2022:10144-1","title":"Security update for gdcm, orthanc, orthanc-gdcm, orthanc-webviewer","description":"This update for gdcm, orthanc, orthanc-gdcm, orthanc-webviewer fixes the following issues:\n\nChanges in gdcm:\n\n- Provides/obsoletes moved to lbgdcm-package (Thx DimStar)\n- rename of gdcm-libgdcm3_0 to libgdcm3_0 (proposal S. Br�ns)\n\n- version 3.0.18\n\n  no changelog\n\n- version 3.0.12\n\n  * support for poppler 22.03 added\n\n- version 3.0.11\n\n  * Fix for a significant issue with JPEG-LS and RGB color space\n  * tons of small bug fixes\n\n- version 3.0.10 (no changelog)\n\nChanges in orthanc-gdcm:\n\n- changed dependency gdcm-libgdcm3_0 -\u003e libgdcm3_0\n\n- Version 1.5 \n\n* Take the configuration option 'RestrictTransferSyntaxes' into\n  account not only for decoding, but also for transcoding\n* Upgrade to GDCM 3.0.10 for static builds- \n\nChanges in orthanc:\n\n- version 1.11.2\n  * Added support for RGBA64 images in tools/create-dicom and /preview\n  * New configuration 'MaximumStorageMode' to choose between recyling of\n    old patients (default behavior) and rejection of new incoming data when\n    the MaximumStorageSize has been reached.\n  * New sample plugin: 'DelayedDeletion' that will delete files from disk\n    asynchronously to speed up deletion of large studies.\n  * Lua: new 'SetHttpTimeout' function\n  * Lua: new 'OnHeartBeat' callback called at regular interval provided that\n       you have configured 'LuaHeartBeatPeriod' \u003e 0.\n  * 'ExtraMainDicomTags' configuration now accepts Dicom Sequences.  Sequences are\n    stored in a dedicated new metadata 'MainDicomSequences'.  This should improve\n    DicomWeb QIDO-RS and avoid warnings like 'Accessing Dicom tags from storage when \n    accessing series : 0040,0275'.\n    Main dicom sequences can now be returned in 'MainDicomTags' and in 'RequestedTags'.\n  * Fix the 'Never' option of the 'StorageAccessOnFind' that was sill accessing\n    files (bug introduced in 1.11.0).\n  * Fix the Storage Cache for compressed files (bug introduced in 1.11.1).\n  * Fix the storage cache that was not used by the Plugin SDK.  This fixes the \n    DicomWeb plugin '/rendered' route performance issues.\n  * DelayedDeletion plugin: Fix leaking of symbols\n  * SQLite now closes and deletes WAL and SHM files on exit.  This should improve\n    handling of SQLite DB over network drives.\n  * Fix static compilation of boost 1.69 on Ubuntu 22.04\n  * Upgraded dependencies for static builds:\n    - boost 1.80.0\n    - dcmtk 3.6.7  (fixes CVE-2022-2119 and CVE-2022-2120)\n    - openssl 3.0.5\n  * Housekeeper plugin: Fix resume of previous processing\n  * Added missing MOVEPatientRootQueryRetrieveInformationModel in \n    DicomControlUserConnection::SetupPresentationContexts()\n  * Improved HttpClient error logging (add method + url)\n  * API version upgraded to 18\n  * /system is now reporting 'DatabaseServerIdentifier'\n  * Added an Asynchronous mode to /modalities/../move.\n  * 'RequestedTags' option can now include DICOM sequences.\n  * New function in the SDK: 'OrthancPluginGetDatabaseServerIdentifier'\n  * DicomMap::ParseMainDicomTags has been deprecated -\u003e retrieve 'full' tags\n    and use DicomMap::FromDicomAsJson instead\n\n- version 1.11.0\n\n* new API version 1.7\n* new configuration parameter\n* for detailed changelog see NEWS\n\n- version 1.10.1\n\n* for detailed changelog see NEWS\n\n- Version 1.9.7\n\n* New configuration option 'DicomAlwaysAllowMove' to disable verification of\n  the remote modality in C-MOVE SCP\n* API version upgraded to 15\n* Added 'Level' option to POST /tools/bulk-modify\n* Added missing OpenAPI documentation of 'KeepSource' in '.../modify' and '.../anonymize'\n* Added file CITATION.cff\n* Linux Standard Base (LSB) builds of Orthanc can load non-LSB builds of plugins\n* Fix upload of ZIP archives containing a DICOMDIR file\n* Fix computation of the estimated time of arrival in jobs\n* Support detection of windowing and rescale in Philips multiframe images \n\nChanges in orthanc-webviewer:\n\n- version 2.8\n  * Fix XSS inside DICOM in Orthanc Web Viewer (as reported by Stuart\n    Kurutac, NCC Group)\n  * framework190.diff removed (covered in actual version)  \n","status":"published","published":"2022-10-12T15:35:18Z","modified":"2026-02-04T04:15:03.039314Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:10145-1","title":"Security update for gdcm, orthanc, orthanc-gdcm, orthanc-webviewer","description":"This update for gdcm, orthanc, orthanc-gdcm, orthanc-webviewer fixes the following issues:\n\nChanges in gdcm:\n\n- rename of gdcm-libgdcm3_0 to libgdcm3_0 (proposal S. Br�ns)\n\n- version 3.0.18\n\n  no changelog\n\n- version 3.0.12\n\n  * support for poppler 22.03 added\n\nChanges in orthanc-gdcm:\n\n- changed dependency gdcm-libgdcm3_0 -\u003e libgdcm3_0\n\nChanges in orthanc:\n\n- version 1.11.2\n  * Added support for RGBA64 images in tools/create-dicom and /preview\n  * New configuration 'MaximumStorageMode' to choose between recyling of\n    old patients (default behavior) and rejection of new incoming data when\n    the MaximumStorageSize has been reached.\n  * New sample plugin: 'DelayedDeletion' that will delete files from disk\n    asynchronously to speed up deletion of large studies.\n  * Lua: new 'SetHttpTimeout' function\n  * Lua: new 'OnHeartBeat' callback called at regular interval provided that\n       you have configured 'LuaHeartBeatPeriod' \u003e 0.\n  * 'ExtraMainDicomTags' configuration now accepts Dicom Sequences.  Sequences are\n    stored in a dedicated new metadata 'MainDicomSequences'.  This should improve\n    DicomWeb QIDO-RS and avoid warnings like 'Accessing Dicom tags from storage when \n    accessing series : 0040,0275'.\n    Main dicom sequences can now be returned in 'MainDicomTags' and in 'RequestedTags'.\n  * Fix the 'Never' option of the 'StorageAccessOnFind' that was sill accessing\n    files (bug introduced in 1.11.0).\n  * Fix the Storage Cache for compressed files (bug introduced in 1.11.1).\n  * Fix the storage cache that was not used by the Plugin SDK.  This fixes the \n    DicomWeb plugin '/rendered' route performance issues.\n  * DelayedDeletion plugin: Fix leaking of symbols\n  * SQLite now closes and deletes WAL and SHM files on exit.  This should improve\n    handling of SQLite DB over network drives.\n  * Fix static compilation of boost 1.69 on Ubuntu 22.04\n  * Upgraded dependencies for static builds:\n    - boost 1.80.0\n    - dcmtk 3.6.7  (fixes CVE-2022-2119 and CVE-2022-2120)\n    - openssl 3.0.5\n  * Housekeeper plugin: Fix resume of previous processing\n  * Added missing MOVEPatientRootQueryRetrieveInformationModel in \n    DicomControlUserConnection::SetupPresentationContexts()\n  * Improved HttpClient error logging (add method + url)\n  * API version upgraded to 18\n  * /system is now reporting 'DatabaseServerIdentifier'\n  * Added an Asynchronous mode to /modalities/../move.\n  * 'RequestedTags' option can now include DICOM sequences.\n  * New function in the SDK: 'OrthancPluginGetDatabaseServerIdentifier'\n  * DicomMap::ParseMainDicomTags has been deprecated -\u003e retrieve 'full' tags\n    and use DicomMap::FromDicomAsJson instead\n\nChanges in orthanc-webviewer:\n\n- version 2.8\n\n  * Fix XSS inside DICOM in Orthanc Web Viewer (as reported by Stuart\n    Kurutac, NCC Group)\n  * framework190.diff removed (covered in actual version)  \n","status":"published","published":"2022-10-12T15:35:24Z","modified":"2026-02-04T02:17:29.940811Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2023:0108-1","title":"Security update for dcmtk","description":"This update for dcmtk fixes the following issues:\n\n- CVE-2022-43272: Fixed memory leak via the T_ASC_Association object (boo#1206070)\n\n- Update to 3.6.7 (boo#1208639, boo#1208638, boo#1208637,\n  CVE-2022-2121, CVE-2022-2120, CVE-2022-2119)\n  - CVE-2022-2121: Fixed possible DoS via NULL pointer dereference\n  - CVE-2022-2120: Fixed relative path traversal vulnerability\n  - CVE-2022-2119: Fixed path traversal vulnerability\n\n  See DOCS/CHANGES.367 for the full list of changes\n\n  * Updated code definitions for DICOM 2022b\n  * Fixed possible NULL pointer dereference\n","status":"published","published":"2023-05-14T22:01:36Z","modified":"2026-02-04T03:44:34.701246Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"USN-5882-1","title":"dcmtk vulnerabilities","description":"Gjoko Krstic discovered that DCMTK incorrectly handled buffers. If a user or\nan automated system were tricked into opening a certain specially crafted \ninput file, a remote attacker could possibly use this issue to cause a \ndenial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2015-8979)\n\nOmar Ganiev discovered that DCMTK incorrectly handled buffers. If a user or\nan automated system were tricked into opening a certain specially crafted \ninput file, a remote attacker could possibly use this issue to cause a \ndenial of service. This issue only affected Ubuntu 16.04 LTS and \nUbuntu 18.04 LTS. (CVE-2019-1010228)\n\nJinsheng Ba discovered that DCMTK incorrectly handled certain requests. If a\nuser or an automated system were tricked into opening a certain specially\ncrafted input file, a remote attacker could possibly use this issue to \ncause a denial of service. This issue only affected Ubuntu 16.04 LTS, \nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2021-41687,\nCVE-2021-41688, CVE-2021-41689, and CVE-2021-41690)\n\nSharon Brizinov and Noam Moshe discovered that DCMTK incorrectly handled\ncertain inputs. If a user or an automated system were tricked into opening\na certain specially crafted input file, a remote attacker could possibly use\nthis issue to execute arbitrary code. This issue only affected \nUbuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.\n(CVE-2022-2119 and CVE-2022-2120)\n\nSharon Brizinov and Noam Moshe discovered that DCMTK incorrectly handled\npointers. If a user or an automated system were tricked into opening a\ncertain specially crafted input file, a remote attacker could possibly use\nthis issue to cause a denial of service. This issue only affected\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.\n(CVE-2022-2121)\n\nIt was discovered that DCMTK incorrectly handled certain inputs. If a\nuser or an automated system were tricked into opening a certain specially\ncrafted input file, a remote attacker could possibly use this issue to \ncause a denial of service. This issue affected Ubuntu 16.04 LTS, \nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10.\n(CVE-2022-43272)\n","status":"published","published":"2023-02-22T18:23:35Z","modified":"2026-08-31T17:15:57.740481573Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}