[From nobody Fri Jun 26 17:41:06 2026 Received: (at submit) by bugs.debian.org; 18 Dec 2025 14:07:17 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, FROMDEVELOPER,HEADER_FROM_DIFFERENT_DOMAINS,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 42; hammy, 150; neutral, 42; spammy, 0. spammytokens: hammytokens:0.000-+--H*F:U*carnil, 0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--HTo:N*Debian, 0.000-+--H*Ad:N*Bug Return-path: <salvatore.bonaccorso@gmail.com> Received: from mail-wm1-x32f.google.com ([2a00:1450:4864:20::32f]:46306) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_128_GCM:128) (Exim 4.96) (envelope-from <salvatore.bonaccorso@gmail.com>) id 1vWEex-00Feyc-1G for submit@bugs.debian.org; Thu, 18 Dec 2025 14:07:17 +0000 Received: by mail-wm1-x32f.google.com with SMTP id 5b1f17b1804b1-4779cb0a33fso7262275e9.0 for <submit@bugs.debian.org>; Thu, 18 Dec 2025 06:07:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1766066833; x=1766671633; darn=bugs.debian.org; h=date:message-id:subject:to:from:content-transfer-encoding :mime-version:sender:from:to:cc:subject:date:message-id:reply-to; bh=OdUk+KJ7dFyMzNoBkdU95x0asxA8pNSvlRdAZyLA2go=; b=TVxP8zBDvHkyGpVUnBpRBhs5+SWfPPmfRgtW0un/kmf+IZ0fADb8OE8Hwz2MmLWzAn CH6ybbQ62S/tXFBNz1Ka8oZVdcyI1FPwVdu8wJclZjDz/M+mnHmy05iR2zvWBSGbtj7x mpTlbBbYaK9jT64HJBXfjRoBlroQFOqMthT5hPxYH+a4z5If+hdZvOkQ/ZFVZIYUkILc pE55Ym382eumMv50JsSfVwi08NJJsXxHePLFYxe/pDD5eTNRD5VCk+VlmXxW/kuUNIGQ 0xCBzwbCDQpqRz5bl1YU2KrIHqdwsfN6saxywrg+Y3u8grIhF0ok9yzdRifYxW3XwAUn qysg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1766066833; x=1766671633; h=date:message-id:subject:to:from:content-transfer-encoding :mime-version:sender:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to; bh=OdUk+KJ7dFyMzNoBkdU95x0asxA8pNSvlRdAZyLA2go=; b=tbzMAT+5pEQiCusk63l9dKQcSOQGSVQOpFXltd8potFJvgT0/AYS/+MLPsw7TX5Pzm rXeS7JNRGqNRLuGjYegEquFOn29Xk3IdeI1sJufkM18qw/VL3GC4SMajLfgYMBrolECK agf69SizCfaP0a7dmBFKBEXaA5n3JdsGqp2LanpeFq1lxeKQ4cHM8Gr8oyXwYz92Yerw EaV/bDNb9koZSUNmZM++DffonPP+H/iw6VptsTwmrZQB4MYmJf08eWr8XjCRNP/0z8ko zVb9xzvkWYDXfY6fL8rR143Q/2BXlhvn7NuU/6bx0R438GUm3y9ayfsbe+XjUdRrJ85d xWbw== X-Gm-Message-State: AOJu0YwSSLDzmAJbQBO8bh4CtiU/WCG9mLw4ikmkIZzmLLdNc8Qwl8MB I3I1/WiI4ufyn+lNK2+82R/9w4cEEAFnsGIVLBl/jtdq3AXavavdvhwA1dQ5d5tP X-Gm-Gg: AY/fxX5fhZfQ337I+ijTao2cHyF+RKw0ZILE9N6i79ih1jXjiSBZB5kC+voAXIPozML JcAPU2WLZ56SjfHyHzJIH6RPZpXj8EKL8ac5A82VUsqqslSX1PRzpCWYh8WcOl6D7ja2eiN0RkN hYzRdixnR+B2H2gWu2KlOIg7O4pUBrEZHRy0Zv98IqU9MZF7x+HkbjzpSgzDvMg2IfNn9oBXtrH Q+qITdarxxDybFiX8J/ckT3xleqN5lQdC2GWF1PfTjcRWBpsqKoHcrOoCnlrMidYh1rc0lzNvD1 a8heqrdigBd6TYiHA/bDWbcqUWqWevvi2UQ79hi0sdX7lkBn2DxRWESm/VaPnrx9CANadNwZkRK VeUT2ppU2HwluN4Sud5iVQmC0H5kVJbS5A4EqNdkiC3U1DzVeNcsVFpy2g1AUB+tt7huYv0BoxG gMHa+uB268oiGy+8NfpqSsRm7FMPTMWhp/DDhi/3pskODzB7g9Qvz5dJY= X-Google-Smtp-Source: AGHT+IF/N+Co66kxM7GFJoAgjMNMHsgkesjkr5QDWRE0MriRIKizzcXT/e0S8y8n3F0w/DeAtY0fxA== X-Received: by 2002:a05:600c:6994:b0:477:a54a:acba with SMTP id 5b1f17b1804b1-47a8f904080mr200174805e9.17.1766056753678; Thu, 18 Dec 2025 03:19:13 -0800 (PST) Received: from eldamar.lan (c-82-192-244-13.customer.ggaweb.ch. [82.192.244.13]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-47be279c5f8sm37438925e9.9.2025.12.18.03.19.12 for <submit@bugs.debian.org> (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 18 Dec 2025 03:19:13 -0800 (PST) Sender: Salvatore Bonaccorso <salvatore.bonaccorso@gmail.com> Received: by eldamar.lan (Postfix, from userid 1000) id 6F349BE2EE7; Thu, 18 Dec 2025 12:19:12 +0100 (CET) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: gdcm: CVE-2025-48429 Message-ID: <176605672515.3132803.1394672965527970370.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0 Date: Thu, 18 Dec 2025 12:18:45 +0100 Delivered-To: submit@bugs.debian.org Source: gdcm Version: 3.0.24-7 Severity: important Tags: security upstream X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org> Hi, The following vulnerability was published for gdcm. CVE-2025-48429[0]: | An out-of-bounds read vulnerability exists in the | RLECodec::DecodeByStreams functionality of Grassroot DICOM 3.024. A | specially crafted DICOM file can lead to leaking heap data. An | attacker can provide a malicious file to trigger this vulnerability. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2025-48429 https://www.cve.org/CVERecord?id=CVE-2025-48429 [1] https://talosintelligence.com/vulnerability_reports/TALOS-2025-2214 Please adjust the affected versions in the BTS as needed. Regards, Salvatore ]