A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, usi...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Debian:12 dcmtk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 dcmtk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9-5+deb13u3"}]}]

Debian:14 dcmtk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0+really3.7.0-7"}]}]

参照URL

advisory security-tracker.debian.org