CVE-2015-8397

High

Published: 12/01/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The JPEGLSCodec::DecodeExtent function in Grassroots DICOM before version 2.6.2 allows remote attackers to obtain sensitive information from process memory or cause application crashes via an embedded JPEG-LS image with dimensions larger than the selected region in a DICOM file.

Risk Assessment

This vulnerability may lead to the disclosure of confidential data or disruption of application functionality, potentially affecting system availability within the organization.

Recommendation

It is recommended to update Grassroots DICOM to version 2.6.2 or later to mitigate this vulnerability.

Other vulnerabilities in Grassroots DICOM (GDCM)

CVE-2015-8396Critical
Integer overflow in the ImageRegionReader::ReadIntoBuffer function in Grassroots DICOM before version 2.6.2 allows attackers to execute arbitrary code via crafted header dimensions in a DICOM image file, triggering a buffer overflow.

Original NVD description (English source)

The JPEGLSCodec::DecodeExtent function in MediaStorageAndFileFormat/gdcmJPEGLSCodec.cxx in Grassroots DICOM (aka GDCM) before 2.6.2 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (application crash) via an embedded JPEG-LS image with dimensions larger than the selected region in a (1) two-dimensional or (2) three-dimensional DICOM image file, which triggers an out-of-bounds read.