Your message dated Sat, 05 Sep 2026 15:32:07 +0000
with message-id <[email protected]>
and subject line Bug#1141411: fixed in dcmtk 3.6.9-5+deb13u3
has caused the Debian Bug report #1141411,
regarding dcmtk: CVE-2026-50003 CVE-2026-50254 CVE-2026-35505 CVE-2026-52868
CVE-2026-44628
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1141411: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141411
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: dcmtk
Version: 3.7.0+really3.7.0-6
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for dcmtk.
I still filled this as RC level, but I'm unsure if they really would
warrant a security advisory, in particular the critical rated one
needs to connect to a malicious DICOM server.
CVE-2026-50003[0]:
| A malicious or compromised server can make a DCMTK client using bit-
| preserving C-GET storage mode write files outside the chosen output
| directory, using both relative (../) paths and absolute paths.
CVE-2026-50254[1]:
| An unauthenticated remote attacker can repeatedly send a single
| crafted connection request to leak memory. Against storescp in its
| default single-process mode, memory grows quickly and the service is
| eventually killed, after which it stops accepting connections until
| an operator restarts it.
CVE-2026-35505[2]:
| An unauthenticated remote attacker can repeatedly send crafted
| connection requests to leak memory. In single-process deployments
| the memory grows until the service is killed and the port stops
| responding until restart.
CVE-2026-52868[3]:
| An unauthenticated attacker can read worklist records from a
| directory outside the intended per-AE worklist storage area. In a
| multi-area deployment, this can cross departmental or clinic data
| separation.
CVE-2026-44628[4]:
| An unauthenticated attacker can crash the worklist server with a
| single crafted query when the server has a valid Called AE Title /
| storage directory, the expected lockfile, and at least one matching
| worklist record.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-50003
https://www.cve.org/CVERecord?id=CVE-2026-50003
[1] https://security-tracker.debian.org/tracker/CVE-2026-50254
https://www.cve.org/CVERecord?id=CVE-2026-50254
[2] https://security-tracker.debian.org/tracker/CVE-2026-35505
https://www.cve.org/CVERecord?id=CVE-2026-35505
[3] https://security-tracker.debian.org/tracker/CVE-2026-52868
https://www.cve.org/CVERecord?id=CVE-2026-52868
[4] https://security-tracker.debian.org/tracker/CVE-2026-44628
https://www.cve.org/CVERecord?id=CVE-2026-44628
[5] https://www.openwall.com/lists/oss-security/2026/07/01/1
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: dcmtk
Source-Version: 3.6.9-5+deb13u3
Done: Étienne Mollier <[email protected]>
We believe that the bug you reported is fixed in the latest version of
dcmtk, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Étienne Mollier <[email protected]> (supplier of updated dcmtk package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 07 Jul 2026 22:38:06 +0200
Source: dcmtk
Architecture: source
Version: 3.6.9-5+deb13u3
Distribution: trixie
Urgency: medium
Maintainer: Debian Med Packaging Team
<[email protected]>
Changed-By: Étienne Mollier <[email protected]>
Closes: 1141411
Changes:
dcmtk (3.6.9-5+deb13u3) trixie; urgency=medium
.
* Team upload.
* d/patches/*-CVE-2026-*.patch: new security patches.
This change includes a patch queue addressing CVE-2026-50003,
CVE-2026-50254, CVE-2026-35505, CVE-2026-52868 and CVE-2026-44628.
The latter CVE-2026-44628 is divided into two patches to match
upstream's commits. These changes fix a range of issues, including
risks of path traversals, denial of services and information leaks.
(Closes: #1141411)
Checksums-Sha1:
b3b23d7d8893669ca5ca8ba42b54e4a80965fcb7 2565 dcmtk_3.6.9-5+deb13u3.dsc
20ff9a3bc830d6eb9f092bddd53077a2d18fa9e4 56416
dcmtk_3.6.9-5+deb13u3.debian.tar.xz
Checksums-Sha256:
1d561eedfa2a06428d3b440858679a86acdf13710731bcf15a0540b367730d30 2565
dcmtk_3.6.9-5+deb13u3.dsc
0f4db4937474e4967bdb30f47527c2f6e55e310da181cbc53bb52f42e1fac7b5 56416
dcmtk_3.6.9-5+deb13u3.debian.tar.xz
Files:
6c8faa561a65a5faf975a69bcd3aceb9 2565 science optional
dcmtk_3.6.9-5+deb13u3.dsc
c4428b369c1cd5c9ca0f25e5d272d138 56416 science optional
dcmtk_3.6.9-5+deb13u3.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQJIBAEBCgAyFiEEj5GyJ8fW8rGUjII2eTz2fo8NEdoFAmqbAnsUHGVtb2xsaWVy
QGRlYmlhbi5vcmcACgkQeTz2fo8NEdojJxAAvX51S2kBt73Bia4mt/8lOyPX/tgQ
uI7RNdg0cvo1pLbMpB+dl+nYFgiCkEbKJQJiz+sq43YRvbfHbp0Z2H1d06sauGs/
eQSIuVrVqnLFFYsESvQCxBVYYW4cw8nrFs+57wiKXGJo1h9FrgZwBDtf2mifuQYb
9GyftIBaETd1GYVs54nd+OVmFhf8OBn/3nx8grCi7n/d2Pkb5bNCZ9WnrRGSL5VQ
dD34WsaY/JGaIEm0RDiwxXNSq7Km/3g901vKtOARj9l7XFzp9peSK5Bdz5p747ug
ltXUoV4DQkKIJJ9TQg5J2fWGGMq6pdg0k8siU6gsvWjfFzSBnxTLiY9zqDAB3T6O
ye3MLpnV77/N62wbxIEzOa0IRS5Jqvrn45yh8QNeqMRL3p7I0T4hMXJfD7sPBMOt
1dEitw6lyNYTE6O8H56XFWoZpF6HaWs35oadrEFhFiDB+EcpGxnR1bm2ICeZ/uxN
rmyT96crA5hvCuMea4h0v2XAvW299NZjDST/YTzu1dewmWbb/ADcaBBhuF0zO6pa
SM+gz8zSolNbyjlPDXeXz0bgFEabwQIsroPqI28/6G5dQFRPbVzyb7DZwgKwcpI0
IPwFY4UPdeinpiZGGwiGvZw6VnX03FMbONdss95f3GSIHIsQmZ0wGaLuWZQn0Twa
ld8AtpJqM/xvq5Y=
=jbK3
-----END PGP SIGNATURE-----
pgpCKRhqe1Fgq.pgp
Description: PGP signature
--- End Message ---
