Skip to content
OpenAdvisories
High USN-5882-1 10 CVEs

dcmtk vulnerabilities

Published Feb 22, 2023 · Updated Aug 31, 2026

Ecosystem: Ubuntu

Summary

Gjoko Krstic discovered that DCMTK incorrectly handled buffers. If a user or
an automated system were tricked into opening a certain specially crafted
input file, a remote attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2015-8979)

Omar Ganiev discovered that DCMTK incorrectly handled buffers. If a user or
an automated system were tricked into opening a certain specially crafted
input file, a remote attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 16.04 LTS and
Ubuntu 18.04 LTS. (CVE-2019-1010228)

Jinsheng Ba discovered that DCMTK incorrectly handled certain requests. If a
user or an automated system were tricked into opening a certain specially
crafted input file, a remote attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2021-41687,
CVE-2021-41688, CVE-2021-41689, and CVE-2021-41690)

Sharon Brizinov and Noam Moshe discovered that DCMTK incorrectly handled
certain inputs. If a user or an automated system were tricked into opening
a certain specially crafted input file, a remote attacker could possibly use
this issue to execute arbitrary code. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.
(CVE-2022-2119 and CVE-2022-2120)

Sharon Brizinov and Noam Moshe discovered that DCMTK incorrectly handled
pointers. If a user or an automated system were tricked into opening a
certain specially crafted input file, a remote attacker could possibly use
this issue to cause a denial of service. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.
(CVE-2022-2121)

It was discovered that DCMTK incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a certain specially
crafted input file, a remote attacker could possibly use this issue to
cause a denial of service. This issue affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10.
(CVE-2022-43272)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS dcmtk 3.6.1~20150924-5ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS dcmtk 3.6.2-3ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS dcmtk 3.6.4-2.1ubuntu0.1~esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS dcmtk 3.6.6-5ubuntu0.1~esm1

Vulnerabilities 10

  • High 7.5
    CVE-2021-41689

    DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would qu…

    dcmtk dcmtk Debian Ubuntu
  • High 7.5
    CVE-2022-2119

    OFFIS DCMTK Path Traversal

    OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.

    OFFIS DCMTK dcmtk dcmtk Debian Ubuntu
  • High 7.5
    CVE-2022-2120

    OFFIS DCMTK Path Traversal

    OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.

    OFFIS DCMTK dcmtk dcmtk Debian Ubuntu
  • High 7.5
    CVE-2022-2121

    OFFIS DCMTK NULL Pointer Dereference

    OFFIS DCMTK's (All versions prior to 3.6.7) has a NULL pointer dereference vulnerability while processing DICOM files, which may result in a denial-of-service condition.

    OFFIS DCMTK dcmtk dcmtk Debian Ubuntu
  • High 7.5
    CVE-2022-43272

    DCMTK v3.6.7 was discovered to contain a memory leak via the T_ASC_Association object.

    dcmtk dcmtk Debian Ubuntu
  • Unscored —
    CVE-2015-8979

    Stack-based buffer overflow in the parsePresentationContext function in storescp in DICOM dcmtk-3.6.0 and earlier allow…

    dcmtk dcmtk Debian Ubuntu
  • Unscored —
    CVE-2019-1010228

    OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed De…

    OFFIS.de DCMTK dcmtk dcmtk Debian Ubuntu
  • Unscored —
    CVE-2021-41687

    DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does n…

    dcmtk dcmtk Debian Ubuntu
  • Unscored —
    CVE-2021-41688

    DCMTK through 3.6.6 does not handle memory free properly. The object in the program is free but its address is still us…

    dcmtk dcmtk Debian Ubuntu
  • Unscored —
    CVE-2021-41690

    DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are reco…

    dcmtk dcmtk Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2015-8979
  • report
    https://ubuntu.com/security/CVE-2019-1010228
  • report
    https://ubuntu.com/security/CVE-2021-41687
  • report
    https://ubuntu.com/security/CVE-2021-41688
  • report
    https://ubuntu.com/security/CVE-2021-41689
  • report
    https://ubuntu.com/security/CVE-2021-41690
  • report
    https://ubuntu.com/security/CVE-2022-2119
  • report
    https://ubuntu.com/security/CVE-2022-2120
  • report
    https://ubuntu.com/security/CVE-2022-2121
  • report
    https://ubuntu.com/security/CVE-2022-43272