CVE-2024-42845

2024-08-2319:15:06

Debian Security Bug Tracker

security-tracker.debian.org

eval injection

invesalius 3.1

dicom file

arbitrary code

unix

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

Low

EPSS

Percentile

16.4%

JSON

An eval Injection vulnerability in the component invesalius/reader/dicom.py of InVesalius 3.1.99991 through 3.1.99998 allows attackers to execute arbitrary code via loading a crafted DICOM file.

OSVersionArchitecturePackageVersionFilename
Debian12allinvesalius<= 3.1.99998-4invesalius_3.1.99998-4_all.deb
Debian11allinvesalius<= 3.1.99994-1invesalius_3.1.99994-1_all.deb
Debian999allinvesalius<= 3.1.99998-5invesalius_3.1.99998-5_all.deb
Debian13allinvesalius<= 3.1.99998-5invesalius_3.1.99998-5_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	invesalius	<= 3.1.99998-4	invesalius_3.1.99998-4_all.deb
Debian	11	all	invesalius	<= 3.1.99994-1	invesalius_3.1.99994-1_all.deb
Debian	999	all	invesalius	<= 3.1.99998-5	invesalius_3.1.99998-5_all.deb
Debian	13	all	invesalius	<= 3.1.99998-5	invesalius_3.1.99998-5_all.deb