CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-28130
https://notcve.org/view.php?id=CVE-2024-28130
An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Existe una vulnerabilidad de conversión de tipo incorrecta en la funcionalidad DVPSSoftcopyVOI_PList::createFromImage de OFFIS DCMTK 3.6.8. Un archivo con formato incorrecto especialmente diseñado puede provocar la ejecución de código arbitrario. • https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html https://talosintelligence.com/vulnerability_reports/TALOS-2024-1957 • CWE-704: Incorrect Type Conversion or Cast •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-43272
https://notcve.org/view.php?id=CVE-2022-43272
DCMTK v3.6.7 was discovered to contain a memory leak via the T_ASC_Association object. Se descubrió que DCMTK v3.6.7 contenía una pérdida de memoria a través del objeto T_ASC_Association. • https://github.com/songxpu/bug_report/tree/master/DCMTK/memory_leak_in_3.6.7 https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4HROBSUUV2LZCYUNODI2YM7G7AYYO75B https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R3QG7MSHORLYAHDXMYG6FQKU4GOCRBCR https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMQ2USESKF6OAZAH64OFHNK2HJIJVGPP https://www.w • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41687
https://notcve.org/view.php?id=CVE-2021-41687
DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sending specific requests to the dcmqrdb program incur the memory leak. An attacker can use it to launch a DoS attack. DCMTK versiones hasta 3.6.6, no maneja apropiadamente la liberación de memoria. • https://github.com/DCMTK/dcmtk https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41688
https://notcve.org/view.php?id=CVE-2021-41688
DCMTK through 3.6.6 does not handle memory free properly. The object in the program is free but its address is still used in other locations. Sending specific requests to the dcmqrdb program will incur a double free. An attacker can use it to launch a DoS attack. DCMTK versiones hasta 3.6.6 no maneja apropiadamente la liberación de memoria. • https://github.com/DCMTK/dcmtk https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html • CWE-415: Double Free •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41690
https://notcve.org/view.php?id=CVE-2021-41690
DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global variable LST and are not freed properly. Sending specific requests to the dcmqrdb program can incur a memory leak. An attacker can use it to launch a DoS attack. DCMTK versiones hasta 3.6.6 no maneja apropiadamente la memoria libre. • https://github.com/DCMTK/dcmtk https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html • CWE-401: Missing Release of Memory after Effective Lifetime •