Hi,

The following vulnerability was published for dcmtk.

CVE-2025-2357[0]:
| A vulnerability was found in DCMTK 3.6.9. It has been declared as
| critical. This vulnerability affects unknown code of the component
| dcmjpls JPEG-LS Decoder. The manipulation leads to memory
| corruption. The attack can be initiated remotely. The exploit has
| been disclosed to the public and may be used. The name of the patch
| is 3239a7915. It is recommended to apply a patch to fix this issue.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-2357
https://www.cve.org/CVERecord?id=CVE-2025-2357
[1] https://support.dcmtk.org/redmine/issues/1155
[2] https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=3239a791542e1ea433d23aaa9e0a05a532ffabff

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hello,

Bug #1100724 in dcmtk reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/med-team/dcmtk/-/commit/cbee9c66123cd2e5d0a1a5b61146a96f760f7bca
------------------------------------------------------------------------
0012-CVE-2025-2357.patch: new: fix CVE-2025-2357.

Closes: #1100724
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1100724

We believe that the bug you reported is fixed in the latest version of
dcmtk, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1100724@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mathieu Malaterre <malat@debian.org> (supplier of updated dcmtk package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 21 Mar 2025 12:45:44 +0100
Source: dcmtk
Architecture: source
Version: 3.6.9-5
Distribution: unstable
Urgency: medium
Maintainer: Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org>
Changed-By: Mathieu Malaterre <malat@debian.org>
Closes: 1095639 1098944 1100724
Changes:
 dcmtk (3.6.9-5) unstable; urgency=medium
 .
   * d/control: relax dependency on dcmtk-data. Closes: #1098944
   * 0012-CVE-2025-2357.patch: new: fix CVE-2025-2357. (Closes: #1100724)
   * documentation: Spring cleanups. Closes: #1095639
Checksums-Sha1:
 8f27e8cf8c6415402e4831fa5116129082fd8c45 2410 dcmtk_3.6.9-5.dsc
 57d4a888fe90135fac15ec02be4c6ccbdd16aaa8 32968 dcmtk_3.6.9-5.debian.tar.xz
 c09ba1615e4e32a31c02f9652c49e96ff9f98630 9120 dcmtk_3.6.9-5_source.buildinfo
Checksums-Sha256:
 68d10827f3cb4da67eb30d957402b3f0e14ab90fb7b929fee8955a59f1eff4c1 2410 dcmtk_3.6.9-5.dsc
 22a522b4afdb0f820351642892f0ee39b5e6c8b205545848e77df2deefb96d92 32968 dcmtk_3.6.9-5.debian.tar.xz
 ffa07bf01cf578da09f8be0125da639466b83b0d0fd3bea6394c904b9ad0c70a 9120 dcmtk_3.6.9-5_source.buildinfo
Files:
 f6db28cf7b64c7d37258ef3c1d93f20c 2410 science optional dcmtk_3.6.9-5.dsc
 b9edb3cf000792021800889f9967e560 32968 science optional dcmtk_3.6.9-5.debian.tar.xz
 13c5c78398ec7f0da6711d22e318add2 9120 science optional dcmtk_3.6.9-5_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEEaTNn/67NjqrNHwY7AXHhgorgk0UFAmfdWf0RHG1hbGF0QGRl
Ymlhbi5vcmcACgkQAXHhgorgk0VjwQ/8DdHnHGr/j16+MLf1qThcfMBsJktbNDnA
Huu/WJ7/b1mZleSWtWQldYrrPKWVEmSZu3/1YcPrIuZI9cvG7aofgZGNGbRqfftX
VCz2Au95iPGP4Fj29I9ZlPW2giMmF080eSCR58xKAenlukWNAt2Cc631w91qI9vH
xD2p9tTDMUQpUJP/OeP4xz28M7CEE0mbw7o/8YWsCUqkzQ/GGhkGnVxV8qmCKPjP
g+T7nvk8qCkcFk1p2cpTZSFtdIfIr0gknNiiQxyVPVqTD0s4mKQjd87f10/fCNlA
oS4P49ZS7RyC910qGMtBdC8Gotg2/xrn4bXUmFr5esGrsDGvOJEjb4w1VVPIPZCZ
gZDlh8x2cXwd0jWAtqY8RmpWQ11wHLoPYwPSzyb9WkqYKLb1s9MAQOz8G3fgS9rU
et60CqBefcl1G1KQRRwP7DySUm5hrxTYOBb9B0KgczzhkCx30aCKLiqGby1t5VD/
u9gQuaXPP2gaURfRd0EE5iMbUn61/fMOZsysLNhkFp3Dsa4CwCgHVO4V9Pr3f3SX
m/oFxoxqCLldcfbmHd7qmeMnSSrshC3kXmuWkbUizBOXkhqxvHD5uHGyWStvLLMG
gWy49uYAV0nnsIiXJjZENzBOPlJSwk8l7qQMhozwUBdeeTvvOlUtZAEVrSrgiLs0
cEtVwAejz+o=
=Eacm
-----END PGP SIGNATURE-----