DCMTK Resource Management Error Vulnerability

DCMTK is DCMTK open source a collection of libraries and applications that implement most of the DICOM standards. Software for examining, building and converting DICOM image files, processing offline media, sending and receiving images over a network connection, and demonstrating image storage an...

PT-2021-23377 · Dcmtk +5 · Dcmtk +5

Name of the Vulnerable Software and Affected Versions: DCMTK versions 3.6.6 and earlier Description: The issue is related to improper memory handling in the DCMTK library, specifically with the global variable LST, which records allocated memory for storing file information but does not free it...

PT-2021-23374 · Dcmtk +5 · Dcmtk +5

Name of the Vulnerable Software and Affected Versions: DCMTK versions prior to 3.6.7 Description: The issue is related to improper memory handling, where an object's memory is freed but its address is still used elsewhere in the program. This can lead to a double free condition when specific...

PT-2021-23375 · Dcmtk +5 · Dcmtk +5

Name of the Vulnerable Software and Affected Versions: DCMTK versions 3.6.6 and earlier Description: The issue is related to improper string copy handling in DCMTK. By sending specific requests to the dcmqrdb program, an attacker can cause the program to query its database and copy the result, ev...

Code injection

1 movescu.cc and 2 storescp.cc in dcmnet/apps/, 3 dcmnet/libsrc/scp.cc, 4 dcmwlm/libsrc/wlmactmg.cc, 5 dcmprscp.cc and 6 dcmpsrcv.cc in dcmpstat/apps/, 7 dcmpstat/tests/msgserv.cc, and 8 dcmqrdb/apps/dcmqrscp.cc in DCMTK 3.6.1 and earlier does not check the return value of the setuid system call,...