[From nobody Fri Jun 26 17:41:04 2026 Received: (at submit) by bugs.debian.org; 18 Dec 2025 13:46:57 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, FROMDEVELOPER,HEADER_FROM_DIFFERENT_DOMAINS,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 51; hammy, 150; neutral, 53; spammy, 0. spammytokens: hammytokens:0.000-+--H*F:U*carnil, 0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--HTo:N*Debian, 0.000-+--H*Ad:N*Bug Return-path: <salvatore.bonaccorso@gmail.com> Received: from mail-ed1-x534.google.com ([2a00:1450:4864:20::534]:49170) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_128_GCM:128) (Exim 4.96) (envelope-from <salvatore.bonaccorso@gmail.com>) id 1vWEKb-00FbIj-2J for submit@bugs.debian.org; Thu, 18 Dec 2025 13:46:16 +0000 Received: by mail-ed1-x534.google.com with SMTP id 4fb4d7f45d1cf-64198771a9bso1090823a12.2 for <submit@bugs.debian.org>; Thu, 18 Dec 2025 05:46:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1766065571; x=1766670371; darn=bugs.debian.org; h=date:message-id:subject:to:from:content-transfer-encoding :mime-version:sender:from:to:cc:subject:date:message-id:reply-to; bh=lOq/cVROKrrwHc7B/YnN+AVen2UnXVLIBRxJnj+HsDA=; b=Z0qpX0Jvf7yW2bt3dWKdOX7JvJhZSQGGQqGrBsr3F2/t0GBMJfxrLMMbkd9Y3Z0Qr8 Vo3+qAuD+TZu/x7WjhuX+QA0Coicitq6UOS9NXR/ncECkB0Tx0oBMrVub8aZcz+iG1T5 FI459c2pKUfNf0LnivHs8MtQ+GWHf/VN1xPstoWtyZ+CI1tnLjHLjMhZEhCXkOPxWqKr LUIYblXw2LcXsbpvC0nnj9NW9vvPcMoTzWYCj/4Jx4rNfiuIlt2LAEJwiI+xuU4uI/44 Se6HTi/6cM2Dk0gB6jF6J1HRzyclGiszDz8CpfatuEZTQYilU/ebM+4nMkMPBOqwsEqZ OgxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1766065571; x=1766670371; h=date:message-id:subject:to:from:content-transfer-encoding :mime-version:sender:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to; bh=lOq/cVROKrrwHc7B/YnN+AVen2UnXVLIBRxJnj+HsDA=; b=AinOpkj5yiPbPzgvaFp6n/8c0t63jWZDfixYNgR18ppf4ebnzdFBKqRl/xylzexChP GQ2d4UHyjSh1DlfAS5w1lB4K/OtzrdKcqqsh4BBbv9+CHSdeZaUrFdhdfCuE/cXEpIV7 L8K/BsupentxtREBKuJ+isfPG/YD8fhUA7vS6BBZkpV350hI26Gu0QaNRWYvYsFio2yO aAOTvwiEmVycIELvx6SUvsL4ugaw/j+IEB3wAaaMmNF+pm0pns/iVOcuSeS68UyJMEc/ FLX+9+abdlLSipQkrDI4dAl7Sv3a6nOK8cE4Vi98XG2Ur2OUtwjns6DH2ClvEP607JRC S/Mw== X-Gm-Message-State: AOJu0Yw4olTndqJ/H+uCwC3bYag3IvJf+aP8U9twrPovleCHbtYXiUCi 5Le5a/n0hbIXnxXvfVdYqfAOLFmsisnBxc9mGfx9qwgls5zqnKK8XMI8cfclVnYO X-Gm-Gg: AY/fxX72F9wUnUG5xIyu8FDDbGp2/CEtyMAMw13UWOKvKI/N3fopwrpLH6dap/UNCrv fCVEXZxhD0SYoOWqAGbJHgND2+ERw8gic3hLtLbe2qD5VFIycQuNSs+GKqxU8hqCrW2hU3B0RBU ehj3AC+sviB3mdT3XpXz0I3dEptxiAuKp4rf0Cs+gW0lf+tV7ZULF21OVvP1qPx/3we46z5V31K WyzTb7TbSMVCTYPyWharnVEtR0282erNKxgsC0SEXeOrwNzuKvsxrPHpSkJHMcdd8rZE7EWCJW6 BHN0xUvuTZpVIcs7/zjhWs6/z66dXrP7j5qu3Q9i6wze0nzlEgvyXRzp4+a2OduGgyS1qB7aT1p PBiTsA1Tbvehf9rHuse4j3m5y9pCKE5piE7ruwoeYOwvmytMjsO7v66+2yQ71KFxSTClqFwSSRU +qscGd+kvW48Ib7+cKy7bZd/0PlKEBPqLnTbZjWEEfLpSq X-Google-Smtp-Source: AGHT+IHOeDlYHwAWxsA86dLUnbvRaUf5HHiL9dZMchtKahkcrtdRi9MHyXiS8hR5Yi/z4RB6gIBVHA== X-Received: by 2002:a05:600c:8b16:b0:477:7c7d:d9b7 with SMTP id 5b1f17b1804b1-47a8f915711mr231478655e9.33.1766056560104; Thu, 18 Dec 2025 03:16:00 -0800 (PST) Received: from eldamar.lan (c-82-192-244-13.customer.ggaweb.ch. [82.192.244.13]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-47be3a9687dsm12718055e9.3.2025.12.18.03.15.59 for <submit@bugs.debian.org> (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 18 Dec 2025 03:15:59 -0800 (PST) Sender: Salvatore Bonaccorso <salvatore.bonaccorso@gmail.com> Received: by eldamar.lan (Postfix, from userid 1000) id 69FCABE2EE7; Thu, 18 Dec 2025 12:15:58 +0100 (CET) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: gdcm: CVE-2025-53618 CVE-2025-53619 Message-ID: <176605654431.3130838.17414260280682346857.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0 Date: Thu, 18 Dec 2025 12:15:44 +0100 Delivered-To: submit@bugs.debian.org Source: gdcm Version: 3.0.24-7 Severity: important Tags: security upstream X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org> Hi, The following vulnerabilities were published for gdcm. CVE-2025-53618[0]: | An out-of-bounds read vulnerability exists in the | JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. | A specially crafted DICOM file can lead to an information leak. An | attacker can provide a malicious file to trigger this | vulnerability.The function `grayscale_convert` is called based of | the value of the malicious DICOM file specifying the intended | interpretation of the image pixel data CVE-2025-53619[1]: | An out-of-bounds read vulnerability exists in the | JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. | A specially crafted DICOM file can lead to an information leak. An | attacker can provide a malicious file to trigger this | vulnerability.The function `null_convert` is called based of the | value of the malicious DICOM file specifying the intended | interpretation of the image pixel data If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2025-53618 https://www.cve.org/CVERecord?id=CVE-2025-53618 [1] https://security-tracker.debian.org/tracker/CVE-2025-53619 https://www.cve.org/CVERecord?id=CVE-2025-53619 [2] https://talosintelligence.com/vulnerability_reports/TALOS-2025-2210 Please adjust the affected versions in the BTS as needed. Regards, Salvatore ]