CVE-2024-28130 Memory corruption in DCMTK
Attackers can achieve arbitrary code execution by providing a specially crafted malformed file to the DCMTK library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-28130?
CVE-2024-28130 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 23 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Weakness: CWE-704
Which versions are affected by CVE-2024-28130?
It affects 2 products.
Linux distribution packages (2)
dcmtk SUSE:Package Hub 15 SP5 | All versions | 3.6.8-bp155.3.3.1 |
dcmtk openSUSE:Leap 15.5 | All versions | 3.6.8-bp155.3.3.1 |
Products include Debian Debian Linux, Offis Dcmtk.
How do I fix CVE-2024-28130?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-28130 being exploited?
There is no known exploitation of CVE-2024-28130 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2024-28130, GHSA-29f8-5v89-7j3x, UBUNTU-CVE-2024-28130, openSUSE-SU-2024:0113-1, openSUSE-SU-2024:13898-1.