This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-41689 →

DEBIAN-CVE-2021-41689

DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the r...

Original description

The description as published by the source.

DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null, which can incur a head-based overflow. An attacker can use it to launch a DoS attack.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 dcmtk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-1"}]}]

Debian:13 dcmtk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-1"}]}]

Debian:14 dcmtk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-1"}]}]

References

advisory security-tracker.debian.org