CVE-2013-6825: High severity OFFIS DCMTK vulnerability
(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprscp.cc and (6) dcmpsrcv.cc in dcmpstat/apps/, (7) dcmpstat/tests/msgserv.cc, and (8) dcmqrdb/apps/dcmqrscp.cc in DCMTK 3.6.1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by creating a large number of processes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6825?
CVE-2013-6825 has a medium severity level due to potential privilege escalation vulnerabilities.
How do I fix CVE-2013-6825?
To fix CVE-2013-6825, update to the latest version of DCMTK which includes patches for the vulnerabilities.
What versions are affected by CVE-2013-6825?
CVE-2013-6825 affects DCMTK versions 3.6.1 and earlier.
What does CVE-2013-6825 exploit?
CVE-2013-6825 exploits the failure to check the return value of setuid in specific DCMTK applications.
Is CVE-2013-6825 a public vulnerability?
Yes, CVE-2013-6825 is a publicly disclosed vulnerability affecting certain DCMTK applications.