CVE-2024-22391 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Dicom

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787 — Out-of-bounds Write5 documents5 sources

Severity

9.8CRITICALNVD

CNA7.7

EPSS

0.2%

top 59.60%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Grassroot Dicom Fedoraproject Fedora Malaterre Grassroots Dicom

Timeline

PublishedApr 25

Description

A heap-based buffer overflow vulnerability exists in the LookupTable::SetLUT functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted malformed file can lead to memory corruption. An attacker can provide a malicious file to trigger this vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDmalaterre/grassroots_dicom3.0.23

▶CVEListV5grassroot_dicom/grassroot_dicom3.0.23

Also affects: Fedora 38, 39, 40

🔴Vulnerability Details

CVEList

CVE-2024-22391: A heap-based buffer overflow vulnerability exists in the LookupTable::SetLUT functionality of Mathieu Malaterre Grassroot DICOM 3↗2024-04-25

▶

OSV

CVE-2024-22391: A heap-based buffer overflow vulnerability exists in the LookupTable::SetLUT functionality of Mathieu Malaterre Grassroot DICOM 3↗2024-04-25

▶

GHSA

GHSA-gm33-c2ph-c6cj: A heap-based buffer overflow vulnerability exists in the LookupTable::SetLUT functionality of Mathieu Malaterre Grassroot DICOM 3↗2024-04-25

▶

📋Vendor Advisories

Debian

CVE-2024-22391: gdcm - A heap-based buffer overflow vulnerability exists in the LookupTable::SetLUT fun...↗2024

▶