From c6742a010d72a194a37187a6bc198d2becf593c3 Mon Sep 17 00:00:00 2001 From: =?utf8?q?=C3=89tienne=20Mollier?= Date: Thu, 11 Jun 2026 20:40:33 +0200 Subject: [PATCH] 0015-CVE-2025-14607.patch: new: fix CVE-2025-14607. Closes: #1122926 --- debian/patches/0015-CVE-2025-14607.patch | 31 ++++++++++++++++++++++++ debian/patches/series | 1 + 2 files changed, 32 insertions(+) create mode 100644 debian/patches/0015-CVE-2025-14607.patch diff --git a/debian/patches/0015-CVE-2025-14607.patch b/debian/patches/0015-CVE-2025-14607.patch new file mode 100644 index 00000000..6d4c30cb --- /dev/null +++ b/debian/patches/0015-CVE-2025-14607.patch @@ -0,0 +1,31 @@ +commit 4c0e5c10079392c594d6a7abd95dd78ac0aa556a +Author: Marco Eichelberg +Date: Tue Dec 2 09:06:30 2025 +0100 + + Fixed bug in handling of odd-length data elements. + + When a dataset containing an illegal odd-length attribute with a text VR + was read from file or received over a network connection, then accessing + the value of that attribute with DcmElement::getString() may return a + pointer to a string that was not properly null terminated. Using C string + functions such as strlen() or strcpy() on that string then lead to a read + beyond the end of a string, causing a segmentation fault. + + Thanks to Zou Dikai for the bug report and POC. + + This closes DCMTK issue #1184. + +--- dcmtk.orig/dcmdata/libsrc/dcbytstr.cc ++++ dcmtk/dcmdata/libsrc/dcbytstr.cc +@@ -658,7 +658,11 @@ + + /* terminate string after real length */ + if (value != NULL) ++ { + value[lengthField] = 0; ++ value[lengthField+1] = 0; ++ } ++ + /* enforce old (pre DCMTK 3.5.2) behaviour? */ + if (!dcmAcceptOddAttributeLength.get()) + { diff --git a/debian/patches/series b/debian/patches/series index 7bd22060..c154368b 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -10,3 +10,4 @@ remove_version.patch 0012-CVE-2025-2357.patch 0013-CVE-2025-9732.patch 0014-CVE-2025-9732b.patch +0015-CVE-2025-14607.patch -- 2.30.2