Activity
From 2026-05-28 to 2026-06-26
2026-06-26
-
07:57 Bug #1233 (Closed): Access-control gap in dcmqrscp
-
-
-
-
-
-
-
-
2026-06-22
-
- As reported by Yuxiao Yan:
|_. File |@dcmqrdb/libsrc/dcmqrdbi.cc@ |
|_. Function |@DcmQueryRetrieveIndexDatabaseH... -
- Fixed with commit 34fa53.
-
- Stack overflow as reported by Yuxiao Yan:
h1. Vulnerability Summary
In `DcmQueryRetrieveIndexDatabaseHandle::... -
- Closed with commit 688a16.
-
- As reported by Yuxiao Yan:
== Summary ==
When parseAssociate() (dcmnet/libsrc/dulparse.cc) fails while pars... -
- Closed by commit 696abc.
-
- As reported by Yuxiao Yan:
Tested version
--------------
- Upstream git, commit 5708ba6c (cloned 2026-06-11)....
2026-06-19
-
- Fixed in commit 782c652.
-
- As reported by Arash Ale Ebrahim:
Summary
-------
The internal getString() helper used by every DIMSE command pa... -
- Fixed in commit e1f914 (and older commit e3878d).
-
- As reported by Arash Ale Ebrahim:
The OFString overload of sanitizeFilename iterates by length() — not until NUL —... -
- Fixed with commit e61270.
-
- As reported by Arash Ale Ebrahim:
The DUL parser allows an A-ASSOCIATE-RQ PDU to contain multiple User Identity N... -
16:39 Bug #1226 (Closed): Unbound recursion in DSRDocumentTreeNode::readXML()
-
- Fixed with commit 537815.
-
- Fix potential heap overflow that could occur if the safety margin of 100 bytes added to the expected PDU length goes ...
-
- Fixed with commit b2d33e.
-
- Using an int instead of size_t for computing the size of a buffer can make the int overflow and therefore create a mu...
-
- Fixed with commit 63b0ba.
-
- Bug reported by Dominik Blain:
An attacker controlling a PTR DNS record can overflow a 260-byte stack buffer on ev... -
2026-06-17
-
- This issue was also reported on 2026-05-19 by Arjun Basnet, Senior Security Researcher, Securin. It has been register...
-
- Closed by commit #9057782f9.
-
- Currently, the XML to DICOM SR parser relies on a depth gate in libxml2 to prevent unbound recursion when reading a m...
-
-
- Closed by commit #cf955e64c.
2026-06-16
-
- Reported 2026-05-19 by Arjun Basnet, Senior Security Researcher, Securin.
-
- This issue has been registered as CVE-2026-44037.
-
- @DcmJsonReaderBase::readValue()@ recurses via @DcmJsonReaderBase::parseSequence()@ on SQ JSON value items with no dep...
-
- Closed by commit #87f256d73.
-
- @DcmXMLParseHelper::parseDataSet()@ at xml2dcm.cc:618 calls @parseSequence()@ for every @<sequence>@ element. @parseS...
2026-06-12
-
-
-
2026-06-11
-
- Fixed with commit b6691c7a0fdfd261c20c2509c2ac16966bd37763
-
- Fixed with commit b818c19720bd3c5c273f7c0578fef3990333af22
-
- Fixed with commit d6ae1bc8d5b9ae9c7300013c8c85cc2ea0fd8cf5.
2026-06-10
-
- DCMTK's bundled CharLS JPEG-LS library (dcmjpls/libcharls) performs an out-of-bounds heap read in its near-lossless d...
-
- DCMTK's bundled CharLS JPEG-LS library (dcmjpls/libcharls) performs an out-of-bounds heap read when finishing decode ...
-
- DCMTK's bundled IJG JPEG library (dcmjpeg/libijg8, and the identical libijg12/libijg16 copies) contains a Huffman-tab...
2026-06-05
-
- Closed by commit #37bbe0f81.
-
- In various places in DCMTK the classes OFDate/Time/DateTime are used to retrieve the current data or time in DICOM fo...
2026-05-31
-
- Closed by commit #d526cbb08.
-
- When loading a compressed DICOM image file that contains an Icon Image Sequence with uncompressed pixel data (which i...
2026-05-29
-
-
- A second leak was discovered during fixing the orginally reported one.
translatePresentationContextList() also now... -
- Bug reported by Abhinav Agarwal.
-
-
- Fixed in commit f4e007468.
-
- Fixed with commit 23f181.
Also available in: Atom