Package: libdcmtk-dev (3.6.9-5+deb13u2)

Published: Oct 8, 2026, 1:17:17 PM UTC

Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service (stack exhau

Published: Oct 8, 2026, 12:55:13 PM UTC

A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries (dcmjpeg/libijg8, libijg12 and libijg16) of OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extend_t

Published: Oct 8, 2026, 12:55:12 PM UTC

Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attac

Published: Oct 8, 2026, 12:55:11 PM UTC

Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM converter (dcmdata/libdcxml/xml2dcm.cc) of OFFIS DCMTK 3.7.0 allows a

Published: Oct 8, 2026, 12:55:10 PM UTC

Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a

Published: Oct 8, 2026, 12:55:09 PM UTC

A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up to 63 bytes of adjacent heap memory, or cause a cr

Published: Oct 8, 2026, 12:55:08 PM UTC

Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service

Published: Sep 24, 2026, 1:52:00 PM UTC

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Att

Published: Jun 30, 2026, 6:00:00 AM UTC

An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. In single-process deployments the memory grows until the service is killed and the port stops respond

La asociación de paquetes está en curso. Observado: Oct 23, 2026, 9:45:19 PM UTC

Published: Jun 30, 2026, 6:00:00 AM UTC

An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage directory, the expected lockfile, and at least one matching

La asociación de paquetes está en curso. Observado: Oct 23, 2026, 9:45:19 PM UTC

Published: Jun 30, 2026, 6:00:00 AM UTC

A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.

La asociación de paquetes está en curso. Observado: Oct 23, 2026, 9:45:19 PM UTC

Published: Jun 30, 2026, 6:00:00 AM UTC

An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default single-process mode, memory grows quickly and the service is

La asociación de paquetes está en curso. Observado: Oct 23, 2026, 9:45:19 PM UTC

Published: Jun 30, 2026, 6:00:00 AM UTC

An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storage area. In a multi-area deployment, this can cross departmental or clinic data separat

La asociación de paquetes está en curso. Observado: Oct 23, 2026, 9:45:20 PM UTC

Published: Jun 21, 2026, 7:15:07 PM UTC

A flaw has been found in OFFIS DCMTK up to 3.7.0. The affected element is the function XMLNode::parseFile in the library ofstd/libsrc/ofxml.cc. Executing a manipulation can lead to heap-based buffer o

La asociación de paquetes está en curso. Observado: Oct 23, 2026, 9:45:34 PM UTC

Published: May 31, 2026, 4:30:08 PM UTC

A weakness has been identified in OFFIS DCMTK 3.7.0. This affects the function DcmQueryRetrieveIndexDatabaseHandle::deleteOldestImages of the file dcmqrdb/libsrc/dcmqrdbi.cc of the component dcmqrscp.

La asociación de paquetes está en curso. Observado: Oct 23, 2026, 9:49:35 PM UTC

Published: Apr 6, 2026, 2:15:11 PM UTC

A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performi

La asociación de paquetes está en curso. Observado: Oct 26, 2026, 2:52:15 AM UTC

Published: Dec 18, 2025, 12:02:08 AM UTC

dcmtk: CVE-2025-14841

La asociación de paquetes está en curso. Observado: Oct 24, 2026, 8:00:22 AM UTC

Published: Dec 13, 2025, 1:02:07 PM UTC

dcmtk: CVE-2025-14607

La asociación de paquetes está en curso. Observado: Oct 24, 2026, 8:18:17 AM UTC

Published: Aug 31, 2025, 2:02:06 PM UTC

dcmtk: CVE-2025-9732

La asociación de paquetes está en curso. Observado: Oct 24, 2026, 7:23:14 PM UTC

Published: Mar 17, 2025, 12:00:00 AM UTC

dcmtk: CVE-2025-2357

La asociación de paquetes está en curso. Observado: Oct 24, 2026, 11:27:14 PM UTC