CVE-2015-8396
Critical · 10.0CVSS
10.0
EPSS
16.0%
Published
Jan 12, 2016
CISA due date
—
The record
Integer overflow in the ImageRegionReader::ReadIntoBuffer function in MediaStorageAndFileFormat/gdcmImageRegionReader.cxx in Grassroots DICOM (aka GDCM) before 2.6.2 allows attackers to execute arbitrary code via crafted header dimensions in a DICOM image file, which triggers a buffer overflow.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | gdcm | 0 | 2.6.2-1 |
| Debian:12 | gdcm | 0 | 2.6.2-1 |
| Debian:13 | gdcm | 0 | 2.6.2-1 |
| Debian:14 | gdcm | 0 | 2.6.2-1 |
| Ubuntu:16.04:LTS | gdcm | 0 | 2.6.2-2 |
| Ubuntu:Pro:14.04:LTS | gdcm | 0 | 2.2.4-1.1ubuntu4+esm1 |
Related vulnerabilities
- CVE-2024-22391 A heap-based buffer overflow vulnerability exists in the LookupTable::SetLUT… Also affects gdcm
- CVE-2024-25569 An out-of-bounds read vulnerability exists in the RAWCodec::DecodeBytes functionality of… Also affects gdcm
- CVE-2024-22373 An out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStreamsCommon… Also affects gdcm
- CVE-2009-3560 The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the… Also affects gdcm
- CVE-2009-3720 The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in… Also affects gdcm
- CVE-2024-50602 An issue was discovered in libexpat before 2.6.4. Also affects gdcm
- CVE-2024-45491 An issue was discovered in libexpat before 2.6.3. Also affects gdcm
- CVE-2024-45492 An issue was discovered in libexpat before 2.6.3. Also affects gdcm