Activity
From 2026-06-04 to 2026-07-03
Today
-
14:32 Bug #1246 (Resolved): SYSS-2026-049: Integer overflow in RLE encoder size check
- Fixed with commit 7e9a836672baad9e3b03fcde160d5e16de681bd5
-
- As reported by Matthias Deeg (SySS GmbH):
h1. SYSS-2026-049 — Integer overflow in RLE encoder size check
|_. Fi... -
- Fixed with commit 225ff1e0e42efcac64a5275e8f06ade14ca509b5
-
- As reported by Matthias Deeg (SySS GmbH):
h1. SYSS-2026-047 — Path traversal in dcmsend --read-from-dicomdir
|_... -
- Fixed with commit 534e146b672ccd13d1a2b134ef623840e775396a
-
- As reported by Matthias Deeg (SySS GmbH):
h1. SYSS-2026-046 — Integer overflow in DICOMDIR PGM icon loading
|_.... -
- Fixed with commit 4c84db4702249593d2fb7f9bc3c90bc7185ababb.
-
- As reported by quellsec.dev:
h2. Summary
Heap out-of-bounds read in CharLS TransformLine: the SOS scan uses the... -
- Closed with commit 99bae4afd570be5f8167dc1d5f48932c00e7346e.
-
- As reported by quellsec.dev:
h1. DCMTK: double-free of palette-color LUT data in IODPaletteColorLUTModule::checkDa... -
- Fixed with commit d0a6f8afaecc676dfc8e36a0ee1a729455a7f74f.
-
- As reported by quellsec.dev:
h2. Summary
@DiOverlayPlane::create6xxx3000Data@ sizes its output buffer as a sing... -
- Fixed with commit 87cccaa50770a00169cf59ec18c63d42175a8d1d.
-
- As reported by quellsec.dev:
h2. Summary
On big-endian hosts, @DiLookupTable::checkTable@ expands an 8-bit-allo... -
- Fixed in commit 345572c45a3767ed25b15c8cf11d4e711cd3d348
-
- Issue as reported by quellsec.dev:
h2. Summary
The bundled CharLS JPEG-LS decoder reads an attacker-controlled ... -
-
- Fixed in commit 2846f2914a6132d58c8e35d4337fccc0e52e3fe7.
-
- h2. Summary
@DcmRLECodecDecoder::decodeFrame@ reads one byte before a heap allocation when the last RLE stripe dec...
2026-07-02
-
-
- Closed by commit bd8163.
2026-06-26
-
-
-
-
-
-
-
-
-
2026-06-22
-
- As reported by Yuxiao Yan:
|_. File |@dcmqrdb/libsrc/dcmqrdbi.cc@ |
|_. Function |@DcmQueryRetrieveIndexDatabaseH... -
- Fixed with commit 34fa53.
-
- Stack overflow as reported by Yuxiao Yan:
h1. Vulnerability Summary
In `DcmQueryRetrieveIndexDatabaseHandle::... -
- Closed with commit 688a16.
-
- As reported by Yuxiao Yan:
== Summary ==
When parseAssociate() (dcmnet/libsrc/dulparse.cc) fails while pars... -
- Closed by commit 696abc.
-
- As reported by Yuxiao Yan:
Tested version
--------------
- Upstream git, commit 5708ba6c (cloned 2026-06-11)....
2026-06-19
-
- Fixed in commit 782c652.
-
- As reported by Arash Ale Ebrahim:
Summary
-------
The internal getString() helper used by every DIMSE command pa... -
- Fixed in commit e1f914 (and older commit e3878d).
-
- As reported by Arash Ale Ebrahim:
The OFString overload of sanitizeFilename iterates by length() — not until NUL —... -
- Fixed with commit e61270.
-
- As reported by Arash Ale Ebrahim:
The DUL parser allows an A-ASSOCIATE-RQ PDU to contain multiple User Identity N... -
16:39 Bug #1226 (Closed): Unbound recursion in DSRDocumentTreeNode::readXML()
-
- Fixed with commit 537815.
-
- Fix potential heap overflow that could occur if the safety margin of 100 bytes added to the expected PDU length goes ...
-
- Fixed with commit b2d33e.
-
- Using an int instead of size_t for computing the size of a buffer can make the int overflow and therefore create a mu...
-
- Fixed with commit 63b0ba.
-
- Bug reported by Dominik Blain:
An attacker controlling a PTR DNS record can overflow a 260-byte stack buffer on ev... -
2026-06-17
-
- This issue was also reported on 2026-05-19 by Arjun Basnet, Senior Security Researcher, Securin. It has been register...
-
- Closed by commit #9057782f9.
-
- Currently, the XML to DICOM SR parser relies on a depth gate in libxml2 to prevent unbound recursion when reading a m...
-
-
- Closed by commit #cf955e64c.
2026-06-16
-
- Reported 2026-05-19 by Arjun Basnet, Senior Security Researcher, Securin.
-
- This issue has been registered as CVE-2026-44037.
-
- @DcmJsonReaderBase::readValue()@ recurses via @DcmJsonReaderBase::parseSequence()@ on SQ JSON value items with no dep...
-
- Closed by commit #87f256d73.
-
- @DcmXMLParseHelper::parseDataSet()@ at xml2dcm.cc:618 calls @parseSequence()@ for every @<sequence>@ element. @parseS...
2026-06-12
-
-
-
2026-06-11
-
- Fixed with commit b6691c7a0fdfd261c20c2509c2ac16966bd37763
-
- Fixed with commit b818c19720bd3c5c273f7c0578fef3990333af22
-
- Fixed with commit d6ae1bc8d5b9ae9c7300013c8c85cc2ea0fd8cf5.
2026-06-10
-
- DCMTK's bundled CharLS JPEG-LS library (dcmjpls/libcharls) performs an out-of-bounds heap read in its near-lossless d...
-
- DCMTK's bundled CharLS JPEG-LS library (dcmjpls/libcharls) performs an out-of-bounds heap read when finishing decode ...
-
- DCMTK's bundled IJG JPEG library (dcmjpeg/libijg8, and the identical libijg12/libijg16 copies) contains a Huffman-tab...
2026-06-05
-
- Closed by commit #37bbe0f81.
-
- In various places in DCMTK the classes OFDate/Time/DateTime are used to retrieve the current data or time in DICOM fo...
Also available in: Atom