CVE-2020-36855: DCMTK dcmqrscp parseQuota stack-based overflow
A security vulnerability has been detected in DCMTK up to 3.6.5. The affected element is the function parseQuota of the component dcmqrscp. The manipulation of the argument StorageQuota leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Upgrading to version 3.6.6 is sufficient to fix this issue. The identifier of the patch is 0fef9f02e. It is recommended to upgrade the affected component.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-36855?
CVE-2020-36855 is considered a critical vulnerability due to the presence of a stack-based buffer overflow.
How does CVE-2020-36855 affect DCMTK?
CVE-2020-36855 affects DCMTK versions up to 3.6.5 and can be exploited by local users to execute arbitrary code.
How do I fix CVE-2020-36855?
To fix CVE-2020-36855, update DCMTK to the latest version that addresses this vulnerability.
What is the attack vector for CVE-2020-36855?
The attack vector for CVE-2020-36855 requires local access to exploit the vulnerability.
Which component of DCMTK is impacted by CVE-2020-36855?
CVE-2020-36855 impacts the parseQuota function within the dcmqrscp component of DCMTK.