Skip to content
OpenAdvisories
High ICSMA-22-174-01 3 CVEs

OFFIS DCMTK

Published Jun 23, 2022 · Updated Jun 23, 2022

Vendor: OFFIS Product: DCMTK

Summary

Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, write malformed DICOM files into arbitrary directories, and gain remote code execution.

Vulnerabilities 3

  • High 7.5
    CVE-2022-2119

    OFFIS DCMTK Path Traversal

    OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.

    OFFIS DCMTK dcmtk dcmtk Debian Ubuntu
  • High 7.5
    CVE-2022-2120

    OFFIS DCMTK Path Traversal

    OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.

    OFFIS DCMTK dcmtk dcmtk Debian Ubuntu
  • High 7.5
    CVE-2022-2121

    OFFIS DCMTK NULL Pointer Dereference

    OFFIS DCMTK's (All versions prior to 3.6.7) has a NULL pointer dereference vulnerability while processing DICOM files, which may result in a denial-of-service condition.

    OFFIS DCMTK dcmtk dcmtk Debian Ubuntu

Revision history

  1. #1

    Publication Date

References