Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-12805 →

DEBIAN-CVE-2026-12805

A flaw has been found in OFFIS DCMTK up to 3.7.0. The affected element is the function XMLNode::parseFile in the library ofstd/libsrc/ofxml.cc. Execut...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

A flaw has been found in OFFIS DCMTK up to 3.7.0. The affected element is the function XMLNode::parseFile in the library ofstd/libsrc/ofxml.cc. Executing a manipulation can lead to heap-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. This patch is called 1d4b3815c0987840a983160bfc671fef63a3105b. It is best practice to apply a patch to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 dcmtk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-9~deb12u4"}]}]

Debian:13 dcmtk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9-5+deb13u2"}]}]

Debian:14 dcmtk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0+really3.7.0-6"}]}]

Références

advisory security-tracker.debian.org