CVE-2025-2357
published 2025-03-17CVE-2025-2357: A vulnerability was found in DCMTK 3.6.9. It has been declared as critical. This vulnerability affects unknown code of the component dcmjpls JPEG-LS Decoder…
PriorityP434medium6.3CVSS 3.1
AVNACLPRNUIRSUCLILAL
EPSS
0.39%
30.9th percentile
A vulnerability was found in DCMTK 3.6.9. It has been declared as critical. This vulnerability affects unknown code of the component dcmjpls JPEG-LS Decoder. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3239a7915. It is recommended to apply a patch to fix this issue.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | dcmtk | < dcmtk 3.6.5-1+deb11u4 (bullseye) | dcmtk 3.6.5-1+deb11u4 (bullseye) |
| offis | dcmtk | — | — |
| offis | dcmtk | >= 0 < 3.6.5-1+deb11u4 | 3.6.5-1+deb11u4 |
| offis | dcmtk | >= 0 < 3.6.9-5 | 3.6.9-5 |
| offis | dcmtk | >= 0 < 3.6.9-5 | 3.6.9-5 |
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv5.3MEDIUM
vendor_redhat7.8HIGH
vendor_debian5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: bpf: Avoid __bpf_prog_ret0_warn when jit fails
vendor_redhat·2025-07-10·CVSS 7.8
CVE-2025-38280 [HIGH] CWE-670 kernel: bpf: Avoid __bpf_prog_ret0_warn when jit fails
kernel: bpf: Avoid __bpf_prog_ret0_warn when jit fails
In the Linux kernel, the following vulnerability has been resolved:
bpf: Avoid __bpf_prog_ret0_warn when jit fails
syzkaller reported an issue:
WARNING: CPU: 3 PID: 217 at kernel/bpf/core.c:2357 __bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357
Modules linked in:
CPU: 3 UID: 0 PID: 217 Comm: kworker/u32:6 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39
RIP: 0010:__bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357
Call Trace:
bpf_dispatcher_nop_func include/linux/bpf.h:1316 [inline]
__bpf_prog_run include/linux/filter.h:718 [inline]
bpf_prog_run include/linux/filter.h:725 [inline]
cls_bpf_classify+0x74a/0x1110 net/sched/cls_bpf.c:105
...
When creating bpf program, 'fp->jit_requested' depends on bpf_jit_enable.
This issue is t
Red Hat
DCMTK: DCMTK dcmjpls JPEG-LS Decoder memory corruption
vendor_redhat·2025-03-17·CVSS 5.3
CVE-2025-2357 [MEDIUM] CWE-119 DCMTK: DCMTK dcmjpls JPEG-LS Decoder memory corruption
DCMTK: DCMTK dcmjpls JPEG-LS Decoder memory corruption
A vulnerability was found in DCMTK 3.6.9. It has been declared as critical. This vulnerability affects unknown code of the component dcmjpls JPEG-LS Decoder. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3239a7915. It is recommended to apply a patch to fix this issue.
A flaw was found in the DCMTK package. Insufficient input data validation can lead to a segmentation fault in the JPEG-LS decoder if invalid input data is processed. This vulnerability affects the component dcmjpls JPEG-LS Decoder. The manipulation leads to memory corruption and can be initiated remotely.
Package: dcmtk (Red Hat Enterprise Linux A
Debian
CVE-2025-2357: dcmtk - A vulnerability was found in DCMTK 3.6.9. It has been declared as critical. This...
vendor_debian·2025·CVSS 5.3
CVE-2025-2357 [MEDIUM] CVE-2025-2357: dcmtk - A vulnerability was found in DCMTK 3.6.9. It has been declared as critical. This...
A vulnerability was found in DCMTK 3.6.9. It has been declared as critical. This vulnerability affects unknown code of the component dcmjpls JPEG-LS Decoder. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3239a7915. It is recommended to apply a patch to fix this issue.
Scope: local
bookworm: open
bullseye: resolved (fixed in 3.6.5-1+deb11u4)
forky: resolved (fixed in 3.6.9-5)
sid: resolved (fixed in 3.6.9-5)
trixie: resolved (fixed in 3.6.9-5)
GHSA
GHSA-vwr6-5rc9-p4cw: A vulnerability was found in DCMTK 3
ghsa_unreviewed·2025-03-17
CVE-2025-2357 [MEDIUM] CWE-119 GHSA-vwr6-5rc9-p4cw: A vulnerability was found in DCMTK 3
A vulnerability was found in DCMTK 3.6.9. It has been declared as critical. This vulnerability affects unknown code of the component dcmjpls JPEG-LS Decoder. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3239a7915. It is recommended to apply a patch to fix this issue.
OSV
CVE-2025-2357: A vulnerability was found in DCMTK 3
osv·2025-03-17·CVSS 5.3
CVE-2025-2357 [MEDIUM] CVE-2025-2357: A vulnerability was found in DCMTK 3
A vulnerability was found in DCMTK 3.6.9. It has been declared as critical. This vulnerability affects unknown code of the component dcmjpls JPEG-LS Decoder. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3239a7915. It is recommended to apply a patch to fix this issue.
No detection rules found.
No public exploits indexed.
2025-03-17
Published