Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2024-22373: Grassroot DICOM 3.0.23 can be crashed by malicious image
CVE-2024-22373 · published 2 years ago
Summary
The Grassroot DICOM software version 3.0.23, as packaged for Debian and Fedora, can be forced to write outside its memory when it processes a specially crafted JPEG2000 image. This could cause the program to stop working or be taken over by an attacker. Update to the latest patched version or apply the vendor's security update to fix the issue.
What to do
- Update debian gdcm to version 3.0.8-2+deb11u1.
- Update debian gdcm to version 3.0.24-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | gdcm |
< 3.0.8-2+deb11u1 Fix: upgrade to 3.0.8-2+deb11u1
|
| Debian:12 | debian | gdcm | All versions |
| Debian:13 | debian | gdcm |
< 3.0.24-1 Fix: upgrade to 3.0.24-1
|
| Debian:14 | debian | gdcm |
< 3.0.24-1 Fix: upgrade to 3.0.24-1
|
| – | grassroot dicom | grassroot dicom | 3.0.23 |
| – | malaterre | grassroots_dicom |
3.0.23 cpe:2.3:a:malaterre:grassroots_dicom:3.0.23:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
38 39 40 cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* |
Original advisory text
An out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap ...
An out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
References
- https://security-tracker.debian.org/tracker/CVE-2024-22373 Vendor Advisory
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1935 URL
- https://lists.fedoraproject.org/archives/list/[email protected]... URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22373... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-22373 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/09/10/13 URL
- https://talosintelligence.com/vulnerability_reports/TALOS-2024-1935 URL
- https://lists.fedoraproject.org/archives/list/[email protected]... URL
- https://lists.fedoraproject.org/archives/list/[email protected]... URL
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-119Buffer Overflow
CWE-787Out-of-bounds Write
Timeline
Published25 Apr 2024
Updated3 Nov 2026
First seen26 Jun 2026
Sources
DEBIAN-CVE-2024-22373 · OSV
CVE-2024-22373 · MITRE
CVE-2024-22373 · NVD
CVE-2024-22373 · OSV
Track software like this
Free during beta