OPENSUSE-SU-2024:0113-1 Security update for dcmtk

This update for dcmtk fixes the following issues: Fixed incorrect type conversion in the DVPSSoftcopyVOIPList:createFromImage functionality of OFFIS DCMTK boo1223324, CVE-2024-28130 - Add missing requirements for dcmtk-devel boo1220809 - Update to 3.6.8 See DOCS/CHANGES.368 for the full list of...

Hyperion input validation vulnerability

Hyperion is an open source bias or ambient lighting implementation of the Hyperion project. An input validation error vulnerability exists in Hyperion version 2.0.15 that stems from the presence of a Unicode conversion vulnerability that could allow an attacker to send Unicode characters with a...

SUSE CVE-2024-28130

An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOIPList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability...

DEBIAN-CVE-2024-28130

An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOIPList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2024-28130

An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOIPList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2024-28130

CVE-2024-28130 affects OFFIS DCMTK 3.6.8 (DVPSSoftcopyVOI_PList::createFromImage) with a malformed file enabling arbitrary code execution. Public references in Debian (DCMTK 3.6.5-1+deb11u1 fix), Ubuntu security advisory USN-7010-1, and Fedora dcmtk 3.6.9-2.fc42 indicate multiple distributions ha...

CVE-2024-28130

An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOIPList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2024-28130

An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOIPList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2024-28130

An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOIPList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2024-28130: Incorrect Type Conversion or Cast

An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOIPList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2024-32662: Out-of-bounds Read

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. This occurs when WCHAR string is read with twice the size it has and converted to UTF-8, base64 decoded. The string is only used to compare against t...

OFFIS DCMTK code-related vulnerabilities

OFFIS DCMTK is a collection of libraries and applications that implement most of the DICOM standards from OFFIS Germany. Software for inspecting, building and converting DICOM image files, processing offline media, sending and receiving images over a network connection, as well as a demo image...

OFFIS DCMTK DVPSSoftcopyVOI_PList::createFromImage incorrect type conversion vulnerability

Talos Vulnerability Report TALOS-2024-1957 OFFIS DCMTK DVPSSoftcopyVOIPList::createFromImage incorrect type conversion vulnerability April 23, 2024 CVE Number CVE-2024-28130 SUMMARY An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOIPList::createFromImage functionality of OFF...

Researchers Uncover Windows Flaws Granting Hackers Rootkit-Like Powers

New research has found that the DOS-to-NT path conversion process could be exploited by threat actors to achieve rootkit-like capabilities to conceal and impersonate files, directories, and processes. "When a user executes a function that has a path argument in Windows, the DOS path at which the...

poppler:qt_pdf_fuzzer: Heap-buffer-overflow in utf16ToUtf8

Project: https://anongit.freedesktop.org/git/poppler/poppler.git https://gitlab.freedesktop.org/poppler/poppler.git https://gitlab.freedesktop.org/ceyhunalp/poppler.git Detailed Report: https://oss-fuzz.com/testcase?key=4797262728331264 Project: poppler Fuzzing Engine: libFuzzer Fuzz Target:...

Tolgee security vulnerabilities

Tolgee is an open source multilingual translation and localization platform designed to help development teams easily manage and maintain multilingual software applications and websites. A security vulnerability exists in Tolgee versions prior to v3.57.2, which stems from a failure to properly...

PT-2024-5390

Name of the Vulnerable Software and Affected Versions cURL affected versions not specified Description The issue is related to the curl url get function in the cURL utility, which is used for Punycode conversions of IDN domains. When a name exactly 256 bytes is converted, it can cause the functio...

Use After Free

SixLabors.ImageSharp is vulnerable to Use After Free. The vulnerability is due to improper input validation within the JPEG and TGA decoders, which allows an attacker to craft malicious image files that could result in Information Disclosure during the conversion process...

Out-of-bounds Write

gtkwave is vulnerable to Out-of-bounds Write. The vulnerability is due to insufficient bounds checking within its VCD parsevaluechange portdump functionality via the vcd2vzt conversion utility. It allows a Crafting a specially designed .vcd file can result in arbitrary code execution...

Out-of-Bounds-Read

gtkwave is vulnerable to Out-of-Bounds-Read. The vulnerability is due to inadequate bounds checking within its VCD var definition section functionality via the vcd2lxt2 conversion utility. It allows a Crafting a specially designed .vcd file can result in arbitrary code execution...