DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global variable LST and are not freed properly. Sending specific requests to the dcmqrdb program can incur a memory leak. An attacker can use it to launch a DoS attack.
References
Link | Resource |
---|---|
https://github.com/DCMTK/dcmtk | Product Third Party Advisory |
https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb | Patch Third Party Advisory |
Configurations
History
06 Jul 2022, 19:43
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-401 | |
CPE | cpe:2.3:a:offis:dcmtk:*:*:*:*:*:*:*:* | |
References | (MISC) https://github.com/DCMTK/dcmtk - Product, Third Party Advisory | |
References | (MISC) https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb - Patch, Third Party Advisory | |
First Time |
Offis dcmtk
Offis |
|
CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
28 Jun 2022, 13:50
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-06-28 13:15
Updated : 2023-12-10 14:22
NVD link : CVE-2021-41690
Mitre link : CVE-2021-41690
CVE.ORG link : CVE-2021-41690
JSON object : View
Products Affected
offis
- dcmtk
CWE
CWE-401
Missing Release of Memory after Effective Lifetime