CVE-2024-34509: Medium severity OFFIS DCMTK vulnerability
dcmdata in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dcmtkto a version that resolves this vulnerability.Fixed in 3.6.7-9~deb12u2 - Upgrade
Upgrade
debian/dcmtkto a version that resolves this vulnerability.Fixed in 3.6.7-14 - Upgrade
Upgrade
debian/dcmtkto a version that resolves this vulnerability.Fixed in 3.6.7-9~deb12u4Fixed in 3.6.9-5+deb13u3Fixed in 3.7.0+really3.7.0-7 - Upgrade
Upgrade
DCMTKto a version that resolves this vulnerability.Fixed in 3.6.9
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34509?
CVE-2024-34509 is classified as a critical vulnerability due to the potential for a segmentation fault that can lead to application crashes.
How do I fix CVE-2024-34509?
To remediate CVE-2024-34509, update dcmtk to version 3.6.9 or later, as this version addresses the segmentation fault issue.
What versions of DCMTK are affected by CVE-2024-34509?
Versions of DCMTK prior to 3.6.9, specifically versions 3.6.8-6 and below, are affected by CVE-2024-34509.
What components are impacted by CVE-2024-34509?
CVE-2024-34509 specifically impacts the dcmdata component in the DCMTK library.
Is there any workaround for CVE-2024-34509?
There are no effective workarounds for CVE-2024-34509 other than upgrading to the fixed version.