PT-2024-10423 · Dcmtk+5 · Dcmtk+5

Nils Bars · Published 2024-03-13 · Updated 2025-09-10 · CVE-2024-34509

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions DCMTK versions prior to 3.6.9

Description The issue is related to a segmentation fault in the dcmdata component of the DCMTK library, which can be triggered by an invalid DIMSE message. This can potentially allow a remote attacker to cause a denial of service.

Recommendations For versions prior to 3.6.9, update to version 3.6.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the dcmdata component to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2025-00955

CVE-2024-34509

DLA-3847-1

DLA-4038-1

DLA-4038-2

MGASA-2024-0251

OPENSUSE-SU-2024:14514-1

OPENSUSE-SU-2025:0053-1

USN-7010-1

Affected Products

Astra Linux

Dcmtk

Debian

Linuxmint

Red Os

Ubuntu

References · 52

• https://github.com/DCMTK/dcmtk/commit/c78e434c0c5f9d932874f0b17a8b4ce305ca01f5 · Patch
• https://osv.dev/vulnerability/DLA-4038-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-43272 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34509 · Security Note
• https://support.dcmtk.org/redmine/issues/1114 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-34509 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2121 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7010-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0114SE18MD · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:0053-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-34509 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-34508 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7010-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2024-0251.html · Security Note
• https://ubuntu.com/security/CVE-2021-41689 · Vendor Advisory