CVE-2024-34508: Null Pointer Dereference
dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dcmtkto a version that resolves this vulnerability.Fixed in 3.6.7-9~deb12u2 - Upgrade
Upgrade
debian/dcmtkto a version that resolves this vulnerability.Fixed in 3.6.7-14 - Upgrade
Upgrade
debian/dcmtkto a version that resolves this vulnerability.Fixed in 3.6.7-9~deb12u4Fixed in 3.6.9-5+deb13u3Fixed in 3.7.0+really3.7.0-7 - Upgrade
Upgrade
DCMTKto a version that resolves this vulnerability.Fixed in 3.6.9
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34508?
CVE-2024-34508 has been categorized as having a high severity due to its potential for causing application crashes.
How do I fix CVE-2024-34508?
To fix CVE-2024-34508, you should upgrade to DCMTK version 3.6.9 or later.
Which versions of DCMTK are affected by CVE-2024-34508?
DCMTK versions from 3.6.5-1 up to and including 3.6.8-6 are affected by CVE-2024-34508.
What type of vulnerability is CVE-2024-34508?
CVE-2024-34508 is a segmentation fault vulnerability triggered by an invalid DIMSE message.
What software is impacted by CVE-2024-34508?
The software impacted by CVE-2024-34508 is the dcmnet component in DCMTK prior to version 3.6.9.