CVE-2024-47796: Buffer Overflow
An improper array index validation vulnerability exists in the nowindow functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dcmtkto a version that resolves this vulnerability.Fixed in 3.6.7-9~deb12u2 - Upgrade
Upgrade
debian/dcmtkto a version that resolves this vulnerability.Fixed in 3.6.8-7 - Upgrade
Upgrade
debian/dcmtkto a version that resolves this vulnerability.Fixed in 3.6.7-9~deb12u4Fixed in 3.6.9-5+deb13u3Fixed in 3.7.0+really3.7.0-7
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47796?
CVE-2024-47796 is classified as a high severity vulnerability due to its potential for exploitation via specially crafted DICOM files.
How do I fix CVE-2024-47796?
To mitigate CVE-2024-47796, ensure you update to the latest version of OFFIS DCMTK that contains a patch for this vulnerability.
What type of vulnerability is CVE-2024-47796?
CVE-2024-47796 is an improper array index validation vulnerability which can lead to an out-of-bounds write.
How can an attacker exploit CVE-2024-47796?
An attacker can exploit CVE-2024-47796 by providing a specially crafted DICOM file that triggers the vulnerability.
Which software is affected by CVE-2024-47796?
CVE-2024-47796 specifically affects OFFIS DCMTK version 3.6.8.