2 lines
2.6 KiB
JSON
2 lines
2.6 KiB
JSON
{"affected":[{"affectedData":[{"product":"DICOM Server","vendor":"Orthanc","versions":[{"lessThanOrEqual":"1.12.10","status":"affected","version":"0","versionType":"custom"}]}],"source":"cret@cert.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:orthanc-server:orthanc:*:*:*:*:*:*:*:*","matchCriteriaId":"A259075D-8B77-4B04-BC42-3E5ABE9DFE1F","versionEndExcluding":"1.12.11","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read vulnerability exists in `DicomStreamReader` during DICOM meta-header parsing. When processing malformed metadata structures, the parser may read beyond the bounds of the allocated metadata buffer. Although this issue does not typically crash the server or expose data directly to the attacker, it reflects insufficient input validation in the parsing logic."},{"lang":"es","value":"Una vulnerabilidad de lectura fuera de límites existe en ’DicomStreamReader’ durante el análisis de meta-cabeceras DICOM. Al procesar estructuras de metadatos malformadas, el analizador puede leer más allá de los límites del búfer de metadatos asignado. Aunque este problema no suele bloquear el servidor ni exponer datos directamente al atacante, refleja una validación de entrada insuficiente en la lógica de análisis."}],"id":"CVE-2026-5437","lastModified":"2026-10-26T21:10:00.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5437","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-14T15:14:39.947635Z","version":"2.0.3"}}]},"published":"2026-04-09T15:16:15.093","references":[{"source":"cret@cert.org","tags":["Third Party Advisory","VDB Entry"],"url":"https://kb.cert.org/vuls/id/536588"},{"source":"cret@cert.org","tags":["Not Applicable"],"url":"https://www.machinespirits.de/"},{"source":"cret@cert.org","tags":["Product"],"url":"https://www.orthanc-server.com/"}],"sourceIdentifier":"cret@cert.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]}
|