CVE-2015-8397: High severity grassroots dicom vulnerability
The JPEGLSCodec::DecodeExtent function in MediaStorageAndFileFormat/gdcmJPEGLSCodec.cxx in Grassroots DICOM (aka GDCM) before 2.6.2 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (application crash) via an embedded JPEG-LS image with dimensions larger than the selected region in a (1) two-dimensional or (2) three-dimensional DICOM image file, which triggers an out-of-bounds read.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8397?
CVE-2015-8397 has been classified as a medium severity vulnerability due to its potential to cause denial of service and leak sensitive information.
How do I fix CVE-2015-8397?
To fix CVE-2015-8397, upgrade to Grassroots DICOM version 2.6.2 or later, as this version resolves the vulnerability.
What type of attack does CVE-2015-8397 enable?
CVE-2015-8397 can allow remote attackers to obtain sensitive information or potentially crash the application.
What is affected by CVE-2015-8397?
CVE-2015-8397 affects all versions of Grassroots DICOM before 2.6.2.
Are there any known exploits for CVE-2015-8397?
Yes, there are known exploits for CVE-2015-8397 that can leverage the vulnerability to obtain sensitive data or disrupt service.