4 matches found
CVE-2022-2120
Offis DCMTK vulnerable: all versions prior to 3.6.7 of the service class user (SCU) in DCMTK allow relative path traversal, enabling writing DICOM files to arbitrary directories and potentially remote code execution. Multiple advisories (Debian DLA-4227, openSUSE/SUSE advisories, Ubuntu USN-5882-...
CVE-2022-2119
CVE-2022-2119 affects OFFIS DCMTK prior to 3.6.7, specifically the SCP service class. The vulnerability is a path traversal flaw that lets an attacker write DICOM files to arbitrary directories with controlled names, potentially enabling remote code execution. Public notices from Debian and openS...
CVE-2026-5663
OFFIS DCMTK up to 3.7.0 contains a vulnerability in the storescp component (dcmnet/apps/storescp.cc: executeOnReception/executeOnEndOfStudy) that allows os command injection through manipulation. Remote exploitation is possible. A patch (edbb085e45788dccaf0e64d71534cfca925784b8) is available and ...