DCMTK Toolkit vulnerabilities
5 known vulnerabilities in DCMTK Toolkit from OFFIS DICOM. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.2 High severity
DCMTK Toolkit: Improper Limitation of a Pathname to a Restricted Directory
An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storage area. In a multi-area deployment, this can cross departmental or clinic data separation.
- 7.5 High severity
DCMTK Toolkit: Missing Release of Memory after Effective Lifetime
An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default single-process mode, memory grows quickly and the service is eventually killed, after which it stops accepting connection
- 9.8 Critical severity
DCMTK Toolkit: Improper Limitation of a Pathname to a Restricted Directory
A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.
- 7.5 High severity
DCMTK Toolkit: Missing Release of Memory after Effective Lifetime
An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. In single-process deployments the memory grows until the service is killed and the port stops responding until restart.
- 7.5 High severity
DCMTK Toolkit: Access of Resource Using Incompatible Type
An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage directory, the expected lockfile, and at least one matching worklist record.