CVE-2024-28130: Incorrect Type Cast
An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOIPList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dcmtkto a version that resolves this vulnerability.Fixed in 3.6.7-9~deb12u3 - Upgrade
Upgrade
debian/dcmtkto a version that resolves this vulnerability.Fixed in 3.6.7-14 - Upgrade
Upgrade
debian/dcmtkto a version that resolves this vulnerability.Fixed in 3.6.7-9~deb12u4Fixed in 3.6.9-5+deb13u3Fixed in 3.7.0+really3.7.0-7
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28130?
CVE-2024-28130 is considered a critical vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2024-28130?
To fix CVE-2024-28130, update your DCMTK package to version 3.6.8-6 or later.
What systems are affected by CVE-2024-28130?
CVE-2024-28130 affects versions of the OFFIS DCMTK software prior to 3.6.8-6.
What type of attack does CVE-2024-28130 enable?
CVE-2024-28130 enables attackers to execute arbitrary code through specially crafted malformed files.
Who can exploit CVE-2024-28130?
Any attacker with the ability to provide a malicious file can exploit CVE-2024-28130.