CVE-2024-22391

NameCVE-2024-22391
DescriptionA heap-based buffer overflow vulnerability exists in the LookupTable::SetLUT functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1070387

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gdcm (PTS)jessie2.4.4-3+deb8u1vulnerable
stretch2.6.6-3vulnerable
buster2.8.8-9vulnerable
bullseye3.0.8-2vulnerable
bookworm3.0.21-1vulnerable
sid, trixie3.0.24-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gdcmsourcejessie(unfixed)end-of-life
gdcmsourcestretch(unfixed)end-of-life
gdcmsource(unstable)3.0.24-11070387

Notes

[bookworm] - gdcm <no-dsa> (Minor issue)
[bullseye] - gdcm <no-dsa> (Minor issue)
[buster] - gdcm <postponed> (Minor issue, follow bullseye)
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1924
https://github.com/malaterre/GDCM/commit/21a793095ab3aecb794c56439873e5b181ea9d91 (v3.0.24)

Search for package or bug name: Reporting problems