Security update for dcmtk SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2023:0108-1 Final 1 1 2023-05-14T22:01:36Z current 2023-05-14T22:01:36Z 2023-05-14T22:01:36Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for dcmtk This update for dcmtk fixes the following issues: - CVE-2022-43272: Fixed memory leak via the T_ASC_Association object (boo#1206070) - Update to 3.6.7 (boo#1208639, boo#1208638, boo#1208637, CVE-2022-2121, CVE-2022-2120, CVE-2022-2119) - CVE-2022-2121: Fixed possible DoS via NULL pointer dereference - CVE-2022-2120: Fixed relative path traversal vulnerability - CVE-2022-2119: Fixed path traversal vulnerability See DOCS/CHANGES.367 for the full list of changes * Updated code definitions for DICOM 2022b * Fixed possible NULL pointer dereference The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2023-108 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MKL5XGJX4U2PD4XAVAZG2YAU2LYKLQIH/ E-Mail link for openSUSE-SU-2023:0108-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1206070 SUSE Bug 1206070 https://bugzilla.suse.com/1208637 SUSE Bug 1208637 https://bugzilla.suse.com/1208638 SUSE Bug 1208638 https://bugzilla.suse.com/1208639 SUSE Bug 1208639 https://www.suse.com/security/cve/CVE-2022-2119/ SUSE CVE CVE-2022-2119 page https://www.suse.com/security/cve/CVE-2022-2120/ SUSE CVE CVE-2022-2120 page https://www.suse.com/security/cve/CVE-2022-2121/ SUSE CVE CVE-2022-2121 page https://www.suse.com/security/cve/CVE-2022-43272/ SUSE CVE CVE-2022-43272 page SUSE Package Hub 15 SP4 openSUSE Leap 15.4 dcmtk-3.6.7-bp154.2.3.1 dcmtk-devel-3.6.7-bp154.2.3.1 libdcmtk17-3.6.7-bp154.2.3.1 dcmtk-3.6.7-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 dcmtk-devel-3.6.7-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 libdcmtk17-3.6.7-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 dcmtk-3.6.7-bp154.2.3.1 as a component of openSUSE Leap 15.4 dcmtk-devel-3.6.7-bp154.2.3.1 as a component of openSUSE Leap 15.4 libdcmtk17-3.6.7-bp154.2.3.1 as a component of openSUSE Leap 15.4 OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution. CVE-2022-2119 SUSE Package Hub 15 SP4:dcmtk-3.6.7-bp154.2.3.1 SUSE Package Hub 15 SP4:dcmtk-devel-3.6.7-bp154.2.3.1 SUSE Package Hub 15 SP4:libdcmtk17-3.6.7-bp154.2.3.1 openSUSE Leap 15.4:dcmtk-3.6.7-bp154.2.3.1 openSUSE Leap 15.4:dcmtk-devel-3.6.7-bp154.2.3.1 openSUSE Leap 15.4:libdcmtk17-3.6.7-bp154.2.3.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MKL5XGJX4U2PD4XAVAZG2YAU2LYKLQIH/ https://www.suse.com/security/cve/CVE-2022-2119.html CVE-2022-2119 https://bugzilla.suse.com/1208637 SUSE Bug 1208637 OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution. CVE-2022-2120 SUSE Package Hub 15 SP4:dcmtk-3.6.7-bp154.2.3.1 SUSE Package Hub 15 SP4:dcmtk-devel-3.6.7-bp154.2.3.1 SUSE Package Hub 15 SP4:libdcmtk17-3.6.7-bp154.2.3.1 openSUSE Leap 15.4:dcmtk-3.6.7-bp154.2.3.1 openSUSE Leap 15.4:dcmtk-devel-3.6.7-bp154.2.3.1 openSUSE Leap 15.4:libdcmtk17-3.6.7-bp154.2.3.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MKL5XGJX4U2PD4XAVAZG2YAU2LYKLQIH/ https://www.suse.com/security/cve/CVE-2022-2120.html CVE-2022-2120 https://bugzilla.suse.com/1208638 SUSE Bug 1208638 OFFIS DCMTK's (All versions prior to 3.6.7) has a NULL pointer dereference vulnerability while processing DICOM files, which may result in a denial-of-service condition. CVE-2022-2121 SUSE Package Hub 15 SP4:dcmtk-3.6.7-bp154.2.3.1 SUSE Package Hub 15 SP4:dcmtk-devel-3.6.7-bp154.2.3.1 SUSE Package Hub 15 SP4:libdcmtk17-3.6.7-bp154.2.3.1 openSUSE Leap 15.4:dcmtk-3.6.7-bp154.2.3.1 openSUSE Leap 15.4:dcmtk-devel-3.6.7-bp154.2.3.1 openSUSE Leap 15.4:libdcmtk17-3.6.7-bp154.2.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MKL5XGJX4U2PD4XAVAZG2YAU2LYKLQIH/ https://www.suse.com/security/cve/CVE-2022-2121.html CVE-2022-2121 https://bugzilla.suse.com/1208639 SUSE Bug 1208639 DCMTK v3.6.7 was discovered to contain a memory leak via the T_ASC_Association object. CVE-2022-43272 SUSE Package Hub 15 SP4:dcmtk-3.6.7-bp154.2.3.1 SUSE Package Hub 15 SP4:dcmtk-devel-3.6.7-bp154.2.3.1 SUSE Package Hub 15 SP4:libdcmtk17-3.6.7-bp154.2.3.1 openSUSE Leap 15.4:dcmtk-3.6.7-bp154.2.3.1 openSUSE Leap 15.4:dcmtk-devel-3.6.7-bp154.2.3.1 openSUSE Leap 15.4:libdcmtk17-3.6.7-bp154.2.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MKL5XGJX4U2PD4XAVAZG2YAU2LYKLQIH/ https://www.suse.com/security/cve/CVE-2022-43272.html CVE-2022-43272 https://bugzilla.suse.com/1206070 SUSE Bug 1206070