PT-2024-21977 · Dc2Niix+1 · Dc2Niix+1

Bananabr · Published 2024-06-28 · Updated 2024-08-01 · CVE-2024-27629

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dc2niix versions prior to 1.0.20240202

Description The issue allows a local attacker to execute arbitrary code via a generated file name that is not properly escaped and injected into a system call when certain types of compression are used.

Recommendations For versions prior to 1.0.20240202, update to version 1.0.20240202 or later to resolve the issue.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2024-27629

Affected Products

Debian

Dc2Niix

References · 8

• https://cve.org/CVERecord?id=CVE-2024-27629 · Security Note
• https://ubuntu.com/security/CVE-2024-27629 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27629 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-27629 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-27629 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-27629 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27629 · Vendor Advisory
• https://github.com/rordenlab/dcm2niix/pull/789 · Note