[From nobody Fri Jun 26 17:41:03 2026 Received: (at submit) by bugs.debian.org; 18 Dec 2025 12:31:30 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, FROMDEVELOPER,HEADER_FROM_DIFFERENT_DOMAINS,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 43; hammy, 150; neutral, 40; spammy, 0. spammytokens: hammytokens:0.000-+--H*F:U*carnil, 0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--HTo:N*Debian, 0.000-+--H*Ad:N*Bug Return-path: <salvatore.bonaccorso@gmail.com> Received: from mail-ej1-x62d.google.com ([2a00:1450:4864:20::62d]:56375) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_128_GCM:128) (Exim 4.96) (envelope-from <salvatore.bonaccorso@gmail.com>) id 1vWCmn-00FJIU-15 for submit@bugs.debian.org; Thu, 18 Dec 2025 12:07:15 +0000 Received: by mail-ej1-x62d.google.com with SMTP id a640c23a62f3a-b7277324204so77932566b.0 for <submit@bugs.debian.org>; Thu, 18 Dec 2025 04:07:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1766059631; x=1766664431; darn=bugs.debian.org; h=date:message-id:subject:to:from:content-transfer-encoding :mime-version:sender:from:to:cc:subject:date:message-id:reply-to; bh=cw/VjNUD6GadRze+/XzaF8g+GX2qV5Qzaul2zDH3jt0=; b=DTXjEVrmM2Kc3/SBG7+s893zbc4ayQw5Tgrv0i2dvq2CH2nXVn4ermtMBSGmKjN94g EAzqJ+GWluMPdha3aRb3X8aKroFrL9GtFMfL4/qts22FnKCoc2RVEZ0EF9EPm7uGGdx7 Chdr7Wy+Xl3mUgs003eXEU9SKAsoVwGCX2hDLgbJ6VtfQ+TDeiy9Bcvh5D3W6dJyGdtP RAkM3c7P5SbgRhyS1PqpIyOhcUBBzkgp874DSWcUYGnGsQ341M08WdTAe2DI3VdFrWfU JV2927J4ZLG5i8OmtsckovKIhqgPbc4d2bTHdzq79iWtTcmd1ZNzc+tSKtBrv9NV/jPy YojA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1766059631; x=1766664431; h=date:message-id:subject:to:from:content-transfer-encoding :mime-version:sender:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to; bh=cw/VjNUD6GadRze+/XzaF8g+GX2qV5Qzaul2zDH3jt0=; b=rlHU5Y5WEzDQ1kRYfmpQm9TYtFfq6Hzlx9mfrjGKowKpw1K3iXRsYm2TE0y/C+oviq Vky64cObuDaElTIdpZSGva/muYpmjCbgKkxTXU2qR0B0oBl/fSrJe1zTf3dNRP1eRb7+ LTFhg7HX0U2MSOpXDsGRol86NbP8VX6J08pd2eKdT+xb3YBTBJOOwiytZU3B64RyN+KP Wcf6sddhl/CRz/spjDnpBRCXNLD95wUCwvWSYBC6fDCk/XvkkyUAHjtCmFaiB5YGD28E q8j49uA00C8XkhinLbIYvk7L6DiuTCpf/X3bn4M8gjLhIO68J/YBOUAfb0A2Pl8QYxLL z1CQ== X-Gm-Message-State: AOJu0YzUIvUUtymL0jC/uTTH1kwfpt2donnw/fpoAMJdD5BUssxSPVp2 /lrNiHXlCRhAEhU4eY3JM8sTvPa9EnWos+JBBRl5pCtFAEHXDdafMD6CxYsp/Gib X-Gm-Gg: AY/fxX7Gu7awJyRsuftatZFQQaDDT8AYahm8YD2U0r/GK3Jwl5TzvcABdaub46/grxQ 2tKBfuEG4pOsXIle4zO2QMOLQ2Uah31U5MZDDEbwHo0w93k04Vf4OoPFrk7zBk6UAUPE8W73eIn BPzm89Ck6SY/bStw5rRk3QB0FeWiSVcDC+P0lfs43RrNrh/cI0X2jPicts41mZ9+hmkgtAXh+Nu VfKl0WpnSOWzQdX9u3ojlFZ+qSlOoOrajIPdC9P5QSfiCElUogTG+iJAFcXW/oQ4eaarSaI/VzY /rrszggGg/3HDaoinnDb7y39zDaf6diu8lHuZDodnxJrFaK1thBR1f9dK4MHnhdmYhhxI16G+5r iUBEBluCdmfqeNaV+2tISqFU24U/mWoG1IiT0pvCc5+kob1dJpDA1JO079UEVSAfnyLUYHtAavp kA4nxodwB7UQZzCL1drM6MDPEZcc5xPigRCJHyi4hWwCq1 X-Google-Smtp-Source: AGHT+IG2rR9LdX20uVUw6ltqETJQwMreI8hO5VgDRhIYETeWiwzDxMqirBeT3equTDawc4hToGuY7A== X-Received: by 2002:a05:6000:2089:b0:430:f879:a0fc with SMTP id ffacd0b85a97d-430f879a220mr14947855f8f.21.1766056658072; Thu, 18 Dec 2025 03:17:38 -0800 (PST) Received: from eldamar.lan (c-82-192-244-13.customer.ggaweb.ch. [82.192.244.13]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-43244999258sm4419557f8f.37.2025.12.18.03.17.37 for <submit@bugs.debian.org> (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 18 Dec 2025 03:17:37 -0800 (PST) Sender: Salvatore Bonaccorso <salvatore.bonaccorso@gmail.com> Received: by eldamar.lan (Postfix, from userid 1000) id 99540BE2EE7; Thu, 18 Dec 2025 12:17:36 +0100 (CET) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: gdcm: CVE-2025-52582 Message-ID: <176605664423.3131699.8196969772107994016.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0 Date: Thu, 18 Dec 2025 12:17:24 +0100 Delivered-To: submit@bugs.debian.org Source: gdcm Version: 3.0.24-7 Severity: important Tags: security upstream X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org> Hi, The following vulnerability was published for gdcm. CVE-2025-52582[0]: | An out-of-bounds read vulnerability exists in the | Overlay::GrabOverlayFromPixelData functionality of Grassroot DICOM | 3.024. A specially crafted DICOM file can lead to an information | leak. An attacker can provide a malicious file to trigger this | vulnerability. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2025-52582 https://www.cve.org/CVERecord?id=CVE-2025-52582 [1] https://talosintelligence.com/vulnerability_reports/TALOS-2025-2211 Please adjust the affected versions in the BTS as needed. Regards, Salvatore ]