PT-2021-23375 · Dcmtk+5 · Dcmtk+5

Jinsheng Ba · Published 2021-07-16 · Updated 2025-04-03 · CVE-2021-41689

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions DCMTK versions 3.6.6 and earlier

Description The issue is related to improper string copy handling in DCMTK. By sending specific requests to the dcmqrdb program, an attacker can cause the program to query its database and copy the result, even if the result is null, leading to a heap-based overflow. This can be exploited to launch a Denial of Service (DoS) attack. The vulnerability can be exploited by a remote attacker.

Recommendations For DCMTK versions 3.6.6 and earlier, as a temporary workaround, consider restricting access to the dcmqrdb program to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2024-15767

ALT-PU-2024-5081

ALT-PU-2025-4731

BDU:2025-03977

CVE-2021-41689

DLA-3847-1

DLA-4038-1

DLA-4038-2

MGASA-2023-0083

ROSA-SA-2025-2643

USN-5882-1

USN-7010-1

Affected Products

Alt Linux

Astra Linux

Dcmtk

Linuxmint

Red Os

Ubuntu

References · 42

• https://github.com/DCMTK/dcmtk/commit/5c14bf53fb42ceca12bbcc0016e8704b1580920d · Patch
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0319SE17 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2121 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-41690 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-0422SE98 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2119 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3847-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0083 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4038-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-1010228 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-41689 · Security Note
• https://ubuntu.com/security/CVE-2015-8979 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41689 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-41687 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/WF2FCZOYXVZ4ETCHO62JWUP4D55UWJCV · Vendor Advisory