Debian Patches

Status for dcmtk/3.6.9-5+deb13u3

Patch Description Author Forwarded Bugs Origin Last update
0007-CVE-2024-47796.patch Fixed issue rendering invalid monochrome image. Fixed issue when rendering an invalid monochrome DICOM image where the
number of pixels stored does not match the expected number of pixels.
If the stored number is less than the expected number, the rest of the
pixel matrix for the intermediate representation was always filled with
the value 0. Under certain, very rare conditions, this could result in
memory problems reported by an Address Sanitizer (ASAN). Now, the rest
of the matrix is filled with the smallest possible value for the image.
.
Thanks to Emmanuel Tacheau from the Cisco Talos team
<vulndiscovery@external.cisco.com> for the original report, the sample
file (PoC) and further details. See TALOS-2024-2122 and CVE-2024-47796.		 Joerg Riesmeier <dicom@jriesmeier.com> yes debian 2025-01-18
01_dcmtk_3.6.0-1.patch The original maintainer Jürgen Salk applied a set of patches to the original code. This file contains
changes to C++ code		 Jürgen Salk <jsa@debian.org> not-needed
07_dont_export_all_executables.patch Don't add executables to cmake exports CMake exports are used by other packages that compile
and link against dcmtk. Because Debian moves some of
these executables and also dosn't install the test
executables, this import may fail leading to failure
to configure the according package.
===================================================================		 Gert Wollny <gw.fossdev@gmail.com> not-needed debian
remove_version.patch Remove version

===================================================================		 Mathieu Malaterre <malat@debian.org> not-needed debian 2025-03-21
0008-CVE-2024-52333.patch Added check to make sure: HighBit < BitsAllocated. Added check to the image preprocessing to make sure that the value of
HighBit is always less than the value of BitsAllocated. Before, this
missing check could lead to memory corruption if an invalid combination
of values was retrieved from a malformed DICOM dataset.
.
Thanks to Emmanuel Tacheau from the Cisco Talos team
<vulndiscovery@external.cisco.com> for the report, sample file (PoC)
and detailed analysis. See TALOS-2024-2121 and CVE-2024-52333.		 Joerg Riesmeier <dicom@jriesmeier.com> yes debian 2025-01-18
0009-CVE-2025-25475.patch commit bffa3e9116abb7038b432443f16b1bd390e80245

Fixed issue with invalid RLE compressed DICOM images.

Fixed issue when processing an RLE compressed image where the RLE header
contains an invalid stripe size.

Thanks to Ding zhengzheng <xiaozheng.ding399@gmail.com> for the report
and the sample file (PoC).		 Marco Eichelberg <eichelberg@offis.de> no 2025-01-23
0010-CVE-2025-25474.patch commit 1d205bcd307164c99e0d4bbf412110372658d847

Fixed another issue with invalid DICOM images.

Fixed issue when processing an invalid DICOM image where the number of
pixels stored does not match the expected number of pixels (too less)
and the combination of BitsAllocated and BitsStored is really unusual
(e.g. 1 bit stored, but 52 bits allocated). In cases where the last
pixel (e.g. a single bit) does not fit into the buffer of the input
pixel data, a buffer overflow occurred on the heap. Now, the last entry
of the buffer is filled with the smallest possible value (e.g. 0 in case
of unsigned data).

Thanks to Ding zhengzheng <xiaozheng.ding399@gmail.com> for the report
and the sample file (PoC).		 Joerg Riesmeier <dicom@jriesmeier.com> no 2025-01-21
0011-CVE-2025-25472.patch commit 410ffe2019b9db6a8f4036daac742a6f5e4d36c2

Fixed another issue with invalid mono images.

Fixed issue when rendering an invalid monochrome DICOM image where the
number of pixels stored does not match the expected number of pixels.
In this case, only a single pixel is processed, but the pixel matrix is
much larger. Filling the rest of the pixel matrix with the smallest
possible value for the image is not working because of an optimized
memory usage (value would be out of range). Now, the pixel value to be
used is double-checked before it is actually filled into the "background"
of the image.

Thanks to Ding zhengzheng <xiaozheng.ding399@gmail.com> for the report
and the sample file (PoC).

diff --git a/dcmimgle/include/dcmtk/dcmimgle/dimoipxt.h b/dcmimgle/include/dcmtk/dcmimgle/dimoipxt.h
index 50389a540..f67967310 100644		 Joerg Riesmeier <dicom@jriesmeier.com> no 2025-01-17
0012-CVE-2025-2357.patch Fixed segfault in JPEG-LS decoder.
Fixed segfault in JPEG-LS decoder.

Fixed a bug in the JPEG-LS decoder that led to a segmentation fault if invalid
input data was processed, due to insufficient validation of input data.

Thanks to Ding zhengzheng <xiaozheng.ding399@gmail.com> for the report
and the sample file (PoC).

This closes DCMTK issue #1155.		 Marco Eichelberg <eichelberg@offis.de> no 2025-03-03
0013-CVE-2025-9732.patch commit 7ad81d69b19714936e18ea5fc74edaeb9f021ce7

Fixed issue with invalid "YBR_FULL" DICOM images.

Fixed an issue when processing an invalid DICOM image with a Photometric
Interpretation of "YBR_FULL" and a Planar Configuration of "1" where
the number of pixels stored does not match the expected number of pixels
(much too less). Now, the pixel data of such an image is not processed
at all, but an empty image (black pixels) is created instead. The user
is warned about this by an appropriate log message.

Thanks to Ding zhengzheng <xiaozheng.ding399@gmail.com> for the report
and the sample file (PoC).		 Joerg Riesmeier <dicom@jriesmeier.com> no 2025-08-15
0014-CVE-2025-9732b.patch commit 3de96da6cd66b1af7224561c568bc3de50cd1398

Fixed issue with commit 7ad81d69b.

Fixed an issue with recently committed changes that fix a problem with
invalid YBR_FULL images

diff --git a/dcmimage/include/dcmtk/dcmimage/diybrpxt.h b/dcmimage/include/dcmtk/dcmimage/diybrpxt.h
index c5415c149..fdaaafc2d 100644		 Joerg Riesmeier <dicom@jriesmeier.com> no 2025-08-18
0015-CVE-2025-14607.patch commit 4c0e5c10079392c594d6a7abd95dd78ac0aa556a

Fixed bug in handling of odd-length data elements.

When a dataset containing an illegal odd-length attribute with a text VR
was read from file or received over a network connection, then accessing
the value of that attribute with DcmElement::getString() may return a
pointer to a string that was not properly null terminated. Using C string
functions such as strlen() or strcpy() on that string then lead to a read
beyond the end of a string, causing a segmentation fault.

Thanks to Zou Dikai <zoudikai@outlook.com> for the bug report and POC.

This closes DCMTK issue #1184.		 Marco Eichelberg <eichelberg@offis.de> no 2025-12-02
0016-CVE-2026-5663.patch commit edbb085e45788dccaf0e64d71534cfca925784b8

Sanitize all strings passed to the exec options.

Sanitize the text fields from incoming DICOM associations and DICOM objects
(such as Study Instance UID, SOP Instance UID, Patient's Name) and the
calling SCU's network presentation address by removing special characters
that may be interpreted as shell escape characters when one of the
execution options (e.g. --exec-on-reception) is in use.

Thanks to Machine Spirits UG (haftungsbeschränkt) for the bug report,
detailed analysis and proof of concept.

This closes DCMTK issue #1194.		 Marco Eichelberg <eichelberg@offis.de> no 2026-03-21
0017-CVE-2025-14841.patch commit ffb1a4a37d2c876e3feeb31df4930f2aed7fa030

Fixed two possible segfaults in dcmqrscp.

Fixed two places where invalid messages may trigger a segmentation fault
due to a NULL pointer being de-referenced.

Thanks to 邹 迪凯 <zoudikai@outlook.com> for the bug report and proof-of-concept.		 Marco Eichelberg <eichelberg@offis.de> no 2025-11-28
0018-CVE-2026-10194.patch commit 0f78a4ef6f645ea5530166e445e5436a5de58e75

Fixed remote heap buffer overflow in dcmqrscp.

Thanks to 'elp3pinill0' for the bug report, detailed
analysis, proof of concept and proposed fix.

This closes DCMTK issue #1206.		 Marco Eichelberg <eichelberg@offis.de> no 2026-05-04
0019-CVE-2026-12805.patch commit 1d4b3815c0987840a983160bfc671fef63a3105b

Fixed buffer overflow in XMLNode::parseFile().

Fixed a heap buffer overflow that could occur in the XML parser
when reading from a named pipe.

Thanks to Cristhian Daniel Rivas Zúñiga and Sebastian Andres Muñoz Morera
(Insituto Tecnológico de Costa Rica) for the bug report and fix.

This closes DCMTK issue #1208.		 Marco Eichelberg <eichelberg@offis.de> no 2026-05-23
0020-CVE-2026-50003.patch Fixed path traversal in DcmSCU bit-pres. C-GET. In DCMSCU_STORAGE_BIT_PRESERVING mode, the C-STORE sub-operation
handler in handleCGETSession() built the on-disk filename from the
peer-supplied AffectedSOPInstanceUID without sanitization, allowing
a malicious C-STORE SCP to write files outside the configured
storage directory via path-separator or "../" sequences in the UID.
.
The DISK mode path was already sanitized (via createStorageFilename(),
fixed in commit f06a86751 for CVE-2022-2120); this branch was missed.
The fix mirrors the same pattern (sanitize a local OFString copy) so
the request struct stays intact and the C-STORE response still echoes
the peer's original UID per protocol.
.
Affects all consumers of DcmSCU using DCMSCU_STORAGE_BIT_PRESERVING,
including getscu --bit-preserving.
.
This fixes DCMTK issue #1207.
.
Thanks to Abhinav Agarwal for the report and analysis.		 Michael Onken <onken@open-connections.de> no debian 2026-05-12
0021-CVE-2026-50254.patch Fix extNegList leaks on A-ASSOCIATE parse failure. Thanks for the report and analysis to Abhinav Agarwal.
.
This closes DCMTK feature #126.		 Michael Onken <onken@open-connections.de> no debian 2026-05-26
0022-CVE-2026-35505.patch Fix A-ASSOCIATE-RQ/AC error-path leaks in DUL FSM. AE_3_AssociateConfirmationAccept and AE_6_ExamineAssociateRequest leaked
the whole parsed PDU graph (presentation contexts, transfer syntax
sub-chains, role list, user info) on error returns taken after
parseAssociate() succeeded, since only the success path freed it. For an
SCP this is remotely triggerable and accumulates per connection.
.
Free the parsed PDU before each such return;
translatePresentationContextList() also frees the proposed transfer
syntax list of a rejected context. Add a dcmnet regression test
(tassocleak.cc) driving the AE_6 zero-transfer-syntax path against an
in-process DcmSCP; leak-clean with the fix under DCMTK_WITH_SANITIZERS.
.
Thanks for the report and analysis to Abhinav Agarwal.
.
This closes DCMTK issue #1217.		 Michael Onken <onken@open-connections.de> no debian 2026-05-29
0023-CVE-2026-52868.patch commit e3878daf870cd2db50eadfde38615f0afae8a584

Fix path traversal in wlmscpfs through Called AET.

The wlmscpfs SCP appended the Called Application Entity Title received
in the A-ASSOCIATE-RQ directly onto the configured worklist data file
path and used the existence of the resulting directory as an access
control decision. Because DICOM VR AE permits the characters "/", "\"
and ".", a peer could send a 16-byte AE title such as "../secret/VICTIM"
and have wlmscpfs serve worklist records from a sibling directory of
the configured root. With option --request-file-path enabled, the same
AE title (and the Patient ID) was substituted into the output filename
template without sanitization, producing an arbitrary-location write
primitive outside the configured request file directory.

This commit closes both holes:

- wlmscpfs now rejects any A-ASSOCIATE-RQ whose Called AE title is not
safe to use as a single filesystem path component, refusing the
association with WLM_BAD_AE_SERVICE. The validation is implemented in
the new static method WlmFileSystemInteractionManager::IsValidAETitle\
ForFilesystem, which rejects empty or over-long titles, any title
containing a dot, and delegates the remaining character check to
OFStandard::sanitizeAETitle (sanitize-and-compare).

- The placeholder substitution in storeRequestToFile now passes each
substituted value (#a, #c, #p) through OFStandard::sanitizeAETitle
before insertion, and additionally sanitizes the final filename, so
that any path separator surviving the substitution is defanged.

Supporting changes:

- Promote storescp's private sanitizeAETitle helper into the public
OFStandard::sanitizeAETitle, with documentation noting that the
function is also used by wlmscpfs to validate filesystem path
components (so widening the allow list has downstream effects).
- Replace storescp's local copy of the helper with the new public one.
- Add a forward declaration of DcmSequenceOfItems in wlfsim.h that
was previously missing (existing callers happened to include dctk.h
first).
- Document the new behaviour in the wlmscpfs man page.

Tests:

- New ofstd_OFStandard_sanitizeAETitle test covers the lifted helper
(path separators, NUL, control bytes, high-range bytes, shell
metacharacters, the quotation-mark preservation behaviour, and
empty/length-1 edge cases).
- New dcmwlm_aetitle_validation test covers the validator directly
with every path-traversal payload from the bug report ("../secret/\
VICTIM", "../CARDIOLOGY", "..", ".", "..\secret"), dotted variants
("MY.AE", "foo..bar", ".foo", "foo."), structural rejections (empty,
17 bytes, embedded NUL, tab, 0xFF), shell metacharacters, and a row
of legitimate AE titles that must still be accepted.
- dcmwlm previously had no OFTEST scaffolding; tests.cc has been added
along with the corresponding CMakeLists.txt and Makefile.in entries.

Thanks to Abhinav Agarwal for the report.		 Michael Onken <onken@open-connections.de> no 2026-05-19
0024-CVE-2026-44628a.patch Fix wlmscpfs crash on VR-spoofed seq. attributes. wldsfs.cc cast findAndGetElement() results to DcmSequenceOfItems*
without checking the VR. A C-FIND with a dictionary-SQ tag declared
under a non-SQ wire VR (Explicit VR) thus dispatched through the wrong
vtable and crashes the SCP (see also CVE-2024-28130 in dcmpstat).
.
Use findAndGetSequence(), which validates the VR. Also guard getItem(0)
against an empty ScheduledProcedureStepSequence and drop a bogus cast.
.
Thanks for the report and analysis to Abhinav Agarwal.
.
This closes DCMTK issue #1218.		 Michael Onken <onken@open-connections.de> no debian 2026-05-29
0025-CVE-2026-44628b.patch Fix VR-spoofed sequence cast crash in wlfsim, too. Apply the same findAndGetSequence() fix to the unchecked casts in
DatasetIsComplete() and ReferencedStudyOrPatientSequenceIsAbsent...()
as in f4e0074.

diff --git a/dcmwlm/libsrc/wlfsim.cc b/dcmwlm/libsrc/wlfsim.cc
index 40a93c4eb..8543f795a 100644		 Michael Onken <onken@open-connections.de> no debian 2026-05-29

All known versions for source package 'dcmtk'

Links