dcmtk: CVE-2025-25475

Debian Bug report logs - #1098373
dcmtk: CVE-2025-25475

Reply or subscribe to this bug.

Display info messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: dcmtk: CVE-2025-25475

Date: Wed, 19 Feb 2025 20:05:22 +0100

Source: dcmtk
Version: 3.6.9-3
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for dcmtk.

CVE-2025-25475[0]:
| A NULL pointer dereference in the component /libsrc/dcrleccd.cc of
| DCMTK v3.6.9+ DEV allows attackers to cause a Denial of Service
| (DoS) via a crafted DICOM file.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-25475
    https://www.cve.org/CVERecord?id=CVE-2025-25475
[1] https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=bffa3e9116abb7038b432443f16b1bd390e80245

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 1098373@bugs.debian.org (full text, mbox, reply):

From: Étienne Mollier <emollier@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 1098373@bugs.debian.org

Subject: Re: [Debian-med-packaging] Bug#1098373: dcmtk: CVE-2025-25475

Date: Wed, 19 Feb 2025 22:05:39 +0100

[Message part 1 (text/plain, inline)]

Control: tags -1 + bookworm
Control: found -1 3.6.7-9~deb12u1
Control: found -1 3.6.7-9~deb12u2

Greetings,

Salvatore Bonaccorso, on 2025-02-19:
> [1] https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=bffa3e9116abb7038b432443f16b1bd390e80245

The change applies without much fuzz on dcmtk in bookworm, which
suggests that the version in stable (and stable-pu) was already
affected.

Have a nice day,  :)
-- 
  .''`.  Étienne Mollier <emollier@debian.org>
 : :' :  pgp: 8f91 b227 c7d6 f2b1 948c  8236 793c f67e 8f0d 11da
 `. `'   sent from /dev/pts/0, please excuse my verbosity
   `-    on air: Moongarden - Castle Of Sand

[signature.asc (application/pgp-signature, inline)]

Message #19 received at 1098373-submitter@bugs.debian.org (full text, mbox, reply):

From: Étienne Mollier <emollier@debian.org>

To: 1098373-submitter@bugs.debian.org

Subject: Bug#1098373 marked as pending in dcmtk

Date: Wed, 19 Feb 2025 21:14:55 +0000

Control: tag -1 pending

Hello,

Bug #1098373 in dcmtk reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/med-team/dcmtk/-/commit/b50ef7d1e65c53c3a7c612efb686f16d41f0e45b

------------------------------------------------------------------------
0009-CVE-2025-25475.patch: new: fix CVE-2025-25475.

Closes: #1098373
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1098373

Send a report that this bug log contains spam.