PT-2021-23373 · Dcmtk+5 · Dcmtk+5

Jinsheng Ba · Published 2021-07-16 · Updated 2025-07-08 · CVE-2021-41687

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions DCMTK versions 3.6.6 and earlier

Description The issue is related to a memory leak in the DCMTK library, which occurs when the program allocates heap memory for parsing data but fails to free it in case of parsing errors. This can be exploited by sending specific requests to the dcmqrdb program, allowing an attacker to launch a Denial of Service (DoS) attack. The vulnerability can be exploited remotely.

Recommendations For DCMTK versions 3.6.6 and earlier, as a temporary workaround, consider restricting access to the dcmqrdb program to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALT-PU-2024-15767

ALT-PU-2024-5081

ALT-PU-2025-4731

BDU:2025-03979

CVE-2021-41687

DLA-3847-1

DLA-4038-1

DLA-4038-2

MGASA-2023-0083

USN-5882-1

USN-7010-1

USN-7010-2

Affected Products

Alt Linux

Astra Linux

Dcmtk

Linuxmint

Red Os

Ubuntu

References · 44

• https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb · Patch
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0319SE17 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-41687 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2121 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-41690 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4038-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41687 · Security Note
• https://ubuntu.com/security/CVE-2022-2119 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3847-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0083 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4038-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7010-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-1010228 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-41687 · Security Note
• https://ubuntu.com/security/notices/USN-7010-2 · Vendor Advisory