Catálogo de CVE

CVE-2021-41689

DCMTK vulnerabilities

DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null, which can incur a head-based overflow. An attacker can use it to launch a DoS attack.

Gravedad: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Jan 1, 2021, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.94% · Oct 27, 2026

Projects and upstream resources

[dcmtk][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	dcmtk	`3.6.7-1`	FixedDistribution-reported fixed boundary	[CVE-2021-41689]
Debiantrixie	dcmtk	`3.6.9-5+deb13u3`	Fixed	[CVE-2021-41689]
Debiansid	dcmtk	`3.6.7-1`	FixedDistribution-reported fixed boundary	[CVE-2021-41689]
Debiansid	dcmtk	`3.7.0+really3.7.0-7`	Fixed	[CVE-2021-41689]
Debianforky	dcmtk	`3.6.7-1`	FixedDistribution-reported fixed boundary	[CVE-2021-41689]
Debianforky	dcmtk	`3.7.0+really3.7.0-7`	Fixed	[CVE-2021-41689]
Debianbookworm	dcmtk	`3.6.7-1`	FixedDistribution-reported fixed boundary	[CVE-2021-41689]
Debianbookworm	dcmtk	`3.6.7-9~deb12u4`	Fixed	[CVE-2021-41689]

Showing 8 fix observations. All 22 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	dcmtk	`3.6.7-9.1ubuntu0.1~esm1`	UnknownSource applicability is not established	Provider not reported
UnknownRelease not reported	dcmtk-doc	`3.6.7-9.1ubuntu0.1~esm1`	UnknownSource applicability is not established	Provider not reported
UnknownRelease not reported	libdcmtk-dev	`3.6.7-9.1ubuntu0.1~esm1`	UnknownSource applicability is not established	Provider not reported
UnknownRelease not reported	libdcmtk17t64	`3.6.7-9.1ubuntu0.1~esm1`	UnknownSource applicability is not established	Provider not reported
Debianbookworm	dcmtk	`3.6.7-1`	FixedDistribution-reported fixed boundary	[CVE-2021-41689]
Debianbookworm	dcmtk	`3.6.7-9~deb12u4`	Fixed	[CVE-2021-41689]
Debianforky	dcmtk	`3.6.7-1`	FixedDistribution-reported fixed boundary	[CVE-2021-41689]
Debianforky	dcmtk	`3.7.0+really3.7.0-7`	Fixed	[CVE-2021-41689]
Debiansid	dcmtk	`3.6.7-1`	FixedDistribution-reported fixed boundary	[CVE-2021-41689]
Debiansid	dcmtk	`3.7.0+really3.7.0-7`	Fixed	[CVE-2021-41689]
Debiantrixie	dcmtk	`3.6.7-1`	FixedDistribution-reported fixed boundary	[CVE-2021-41689]
Debiantrixie	dcmtk	`3.6.9-5+deb13u3`	Fixed	[CVE-2021-41689]
Ubuntu20.04	dcmtk	`3.6.4-2.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-41689]Apr 22, 2026, 1:01:56 PM UTC
Ubuntu20.04	dcmtk	`3.6.4-2.1build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-41689]Apr 22, 2026, 1:01:56 PM UTC
Ubuntu20.04	dcmtk	`3.6.4-2.1build2`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-41689]Apr 22, 2026, 1:01:56 PM UTC
Ubuntu20.04	dcmtk	`3.6.4-2.1ubuntu0.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-41689]Apr 22, 2026, 1:01:56 PM UTC
Ubuntupro	dcmtk	`3.6.5-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-41689]Apr 22, 2026, 1:01:56 PM UTC
Ubuntupro	dcmtk	`3.6.6-3ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-41689]Apr 22, 2026, 1:01:56 PM UTC
Ubuntupro	dcmtk	`3.6.6-3ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-41689]Apr 22, 2026, 1:01:56 PM UTC
Ubuntupro	dcmtk	`3.6.6-4`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-41689]Apr 22, 2026, 1:01:56 PM UTC
Ubuntupro	dcmtk	`3.6.6-5`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-41689]Apr 22, 2026, 1:01:56 PM UTC
Ubuntupro	dcmtk	`3.6.6-5ubuntu0.1~esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-41689]Apr 22, 2026, 1:01:56 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "dcmtk",
      "status": "fixed",
      "release": "sid",
      "version": "3.7.0+really3.7.0-7"
    },
    {
      "name": "dcmtk",
      "status": "fixed",
      "release": "forky",
      "version": "3.7.0+really3.7.0-7"
    },
    {
      "name": "dcmtk",
      "status": "fixed",
      "release": "trixie",
      "version": "3.6.9-5+deb13u3"
    },
    {
      "name": "dcmtk",
      "status": "fixed",
      "release": "bookworm",
      "version": "3.6.7-9~deb12u4"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "dcmtk",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "3.6.7-1"
    },
    {
      "bug": null,
      "name": "dcmtk",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "3.6.7-1"
    },
    {
      "bug": null,
      "name": "dcmtk",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "3.6.7-1"
    },
    {
      "bug": null,
      "name": "dcmtk",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "3.6.7-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "dcmtk",
      "fixed_version": "3.6.7-9.1ubuntu0.1~esm1",
      "applicability_unknown": true
    },
    {
      "name": "dcmtk-doc",
      "fixed_version": "3.6.7-9.1ubuntu0.1~esm1",
      "applicability_unknown": true
    },
    {
      "name": "libdcmtk-dev",
      "fixed_version": "3.6.7-9.1ubuntu0.1~esm1",
      "applicability_unknown": true
    },
    {
      "name": "libdcmtk17t64",
      "fixed_version": "3.6.7-9.1ubuntu0.1~esm1",
      "applicability_unknown": true
    },
    {
      "name": "dcmtk",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.6-5ubuntu0.1~esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "3.6.5-1",
        "3.6.6-3ubuntu1",
        "3.6.6-3ubuntu2",
        "3.6.6-4",
        "3.6.6-5"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-41689",
      "fixed_version": "3.6.6-5ubuntu0.1~esm1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-41689",
      "provider_updated_at": "2026-04-22T13:01:56.677715Z",
      "applicability_unknown": true
    },
    {
      "name": "dcmtk",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.4-2.1ubuntu0.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "3.6.4-2.1",
        "3.6.4-2.1build1",
        "3.6.4-2.1build2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-41689",
      "fixed_version": "3.6.4-2.1ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-41689",
      "provider_updated_at": "2026-04-22T13:01:56.677715Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

La asociación de paquetes está en curso.

[Debian 12 (Bookworm)]

[dcmtk]Desconocido
Detalles (2)
- 3.6.7-9~deb12u4 · amd64 · bookworm
  Corregida · Corregida: 3.6.7-1
  usn · dcmtk · debian · bookworm; usn · dcmtk · debian · 12
- 3.6.7-9~deb12u4 · arm64 · bookworm
  Corregida · Corregida: 3.6.7-1
  usn · dcmtk · debian · bookworm; usn · dcmtk · debian · 12
[dcmtk-doc]Desconocido
Paquete fuente: [dcmtk]
Detalles (2)
- 3.6.7-9~deb12u4 · all · bookworm
  Corregida · Corregida: 3.6.7-1
  usn · dcmtk · debian · bookworm; usn · dcmtk · debian · 12
- 3.6.7-9~deb12u4 · all · bookworm
  Corregida · Corregida: 3.6.7-1
  usn · dcmtk · debian · bookworm; usn · dcmtk · debian · 12
[libdcmtk17]Desconocido
Paquete fuente: [dcmtk]
Detalles (2)
- 3.6.7-9~deb12u4 · amd64 · bookworm
  Corregida · Corregida: 3.6.7-1
  usn · dcmtk · debian · bookworm; usn · dcmtk · debian · 12
- 3.6.7-9~deb12u4 · arm64 · bookworm
  Corregida · Corregida: 3.6.7-1
  usn · dcmtk · debian · bookworm; usn · dcmtk · debian · 12
[libdcmtk-dev]Desconocido
Paquete fuente: [dcmtk]
Detalles (2)
- 3.6.7-9~deb12u4 · amd64 · bookworm
  Corregida · Corregida: 3.6.7-1
  usn · dcmtk · debian · bookworm; usn · dcmtk · debian · 12
- 3.6.7-9~deb12u4 · arm64 · bookworm
  Corregida · Corregida: 3.6.7-1
  usn · dcmtk · debian · bookworm; usn · dcmtk · debian · 12

[Debian 13 (Trixie)]

[dcmtk]Desconocido
Detalles (2)
- 3.6.9-5+deb13u2 · amd64 · trixie
  Corregida · Corregida: 3.6.7-1
  usn · dcmtk · debian · 13
- 3.6.9-5+deb13u2 · arm64 · trixie
  Corregida · Corregida: 3.6.7-1
  usn · dcmtk · debian · 13
[dcmtk-data]Desconocido
Paquete fuente: [dcmtk]
Detalles (2)
- 3.6.9-5+deb13u2 · all · trixie
  Corregida · Corregida: 3.6.7-1
  usn · dcmtk · debian · 13
- 3.6.9-5+deb13u2 · all · trixie
  Corregida · Corregida: 3.6.7-1
  usn · dcmtk · debian · 13
[dcmtk-doc]Desconocido
Paquete fuente: [dcmtk]
Detalles (2)
- 3.6.9-5+deb13u2 · all · trixie
  Corregida · Corregida: 3.6.7-1
  usn · dcmtk · debian · 13
- 3.6.9-5+deb13u2 · all · trixie
  Corregida · Corregida: 3.6.7-1
  usn · dcmtk · debian · 13
[libdcmtk19]Desconocido
Paquete fuente: [dcmtk]
Detalles (2)
- 3.6.9-5+deb13u2 · amd64 · trixie
  Corregida · Corregida: 3.6.7-1
  usn · dcmtk · debian · 13
- 3.6.9-5+deb13u2 · arm64 · trixie
  Corregida · Corregida: 3.6.7-1
  usn · dcmtk · debian · 13
[libdcmtk-dev]Desconocido
Paquete fuente: [dcmtk]
Detalles (2)
- 3.6.9-5+deb13u2 · amd64 · trixie
  Corregida · Corregida: 3.6.7-1
  usn · dcmtk · debian · 13
- 3.6.9-5+deb13u2 · arm64 · trixie
  Corregida · Corregida: 3.6.7-1
  usn · dcmtk · debian · 13

Observado: Oct 23, 2026, 6:02:55 PM UTC

Referencias

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]